Description
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.
Affected products
mozilla: thunderbird
References3
- www.mozilla.org/security/advisories/mfsa2026-71/ Vendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-72/ Vendor Advisory
- bugzilla.mozilla.org/show_bug.cgi?id=2046137 Permissions Required
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 41 · as of 14 November 2026
- CWE
- CWE-193
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.