CVE-2021-4126

What it actually does

When an OpenPGP/MIME signed email contains an additional outer MIME layer, only the inner signed message is validated for signature status, allowing unsigned outer content to appear covered by the signature.

Why it matters to the business

Recipients may trust and act on email content that has been altered after signing, increasing risk of successful social engineering or misinformation in organizational communications.

How an attack unfolds

An attacker crafts or intercepts an OpenPGP signed email, wraps it with an additional unsigned outer MIME layer such as a mailing list footer, and delivers it so the client displays a valid signature status for the entire message including the attacker's additions.

How to fix it

Upgrade affected Thunderbird installations to version 91.4.1 or later; ensure all clients enforce signature validation only on the top-level MIME part.

How to confirm the fix worked

Confirm client version is at least 91.4.1 and test with sample emails containing outer MIME layers to verify signature status is limited to the top-level part.

Typical attack path

1. Obtain or create a legitimately signed OpenPGP/MIME email
2. Insert an additional outer MIME part containing attacker-controlled content
3. Deliver the message via a mailing list or direct SMTP
4. Victim client displays signature validity for the full message

How to detect it

Review email client logs and MIME structure of received messages for nested signed parts with additional outer layers; search message stores for OpenPGP signature status indicators paired with multi-layer MIME content.

What your security team should do

• Prioritize patching all Thunderbird instances to 91.4.1 or newer
• Educate users on verifying signatures manually when receiving forwarded or list-processed mail
• Monitor for any remaining pre-91.4.1 deployments via inventory scans