Description
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Published: 2026-09-15
Score: 3.4 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (application crash)
Action: Apply Patch
AI Analysis

Impact

An untrusted IMAP server can send an untagged '* ID' response that triggers an out-of-bounds read in Thunderbird’s IMAP response parser before authentication has completed. The read causes the application to crash, effectively denying service to the user. This is a classic out‑of‑bounds read flaw (CWE‑125) and does not provide remote code execution or data disclosure.

Affected Systems

Mozilla Thunderbird versions earlier than 156, 140.16, and 153.3 are affected. The fix is included in Thunderbird releases 156, 140.16, and 153.3 and later.

Risk and Exploitability

The CVSS score of 3.4 indicates a low severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to act as an IMAP server to send malformed responses, so the attack vector is remote and requires no authentication on the client side, but the overall risk is low.

Generated by OpenCVE AI on September 17, 2026 at 05:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Thunderbird to version 156 or later.
  • Upgrade Thunderbird to version 140.16 or later.
  • Upgrade Thunderbird to version 153.3 or later.

Generated by OpenCVE AI on September 17, 2026 at 05:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4782-1 thunderbird security update
Debian DSA Debian DSA DSA-6503-1 thunderbird security update
History

Wed, 16 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Mozilla
Mozilla thunderbird
Vendors & Products Mozilla
Mozilla thunderbird

Wed, 16 Sep 2026 14:45:00 +0000

Type Values Removed Values Added
Description A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
References

Wed, 16 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N'}

threat_severity

Low

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 140.16. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
References

Tue, 15 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 140.16.
Title Out-of-bounds read in IMAP response parser
References

Subscriptions

Mozilla Thunderbird
cve-icon MITRE

Status: PUBLISHED

Assigner: mozilla

Published:

Updated: 2026-09-16T14:24:29.413Z

Reserved: 2026-09-15T19:42:52.961Z

Link: CVE-2026-92240

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:19:41.677

Modified: 2026-09-16T19:34:05.910

Link: CVE-2026-92240

cve-icon Redhat

Severity : Low

Publid Date: 2026-09-15T19:42:53Z

Links: CVE-2026-92240 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:00:09Z

Weaknesses