A maliciously crafted mail header can trigger a one‑byte read past the end of a buffer in the Thunderbird mail parser. This over‑read could expose adjacent memory contents, potentially leaking sensitive data. The flaw does not provide a direct code execution path or denial of service, but may compromise confidentiality of header information or hidden data stored near the buffer.

Mozilla’s Thunderbird email client is affected. The vulnerability is fixed in Thunderbird 155, 140.15, and 153.2, so any older installations of these releases are vulnerable.

The EPSS score is not available and the vulnerability is not in the CISA KEV catalog, indicating no public exploitation data. The attack vector is inferred to be a malicious email sent to the client, as the flaw occurs during header parsing. While the impact is limited to data exposure, the lack of a severity assessment suggests a low‑to‑moderate risk. Applying the available fixes remains the recommended mitigation.