CVE-2021-43529

What it actually does

Heap overflow triggered when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures, allowing memory corruption.

Why it matters to the business

Attackers can execute arbitrary code on affected systems, leading to full compromise of email clients and potential data theft or ransomware deployment; low exploit maturity reduces immediate urgency but requires prompt patching of all instances.

How an attack unfolds

An attacker crafts a malicious S/MIME email containing a certificate with a DER-encoded DSA or RSA-PSS signature. When the vulnerable client processes the message, the heap overflow is triggered, enabling code execution without user interaction beyond opening the message.

How to fix it

Upgrade all affected instances of 202ecommerce/paypal (GIT) to one of the fixed commits: 2f6884ea1d0fe4b58441699fcc1d6c56c7d733eb or 799fe76b453c74c5922a03063dd3b5650ae49216. Ensure Thunderbird-based components or dependencies are at version 91.3.0 or later to avoid invoking the vulnerable code path.

How to confirm the fix worked

Verify package versions match the listed fixed commits; test S/MIME message processing with DSA/RSA-PSS certificates to confirm no crash or overflow occurs.

Typical attack path

1. Craft malicious S/MIME message with specially formed certificate
2. Deliver message via email to target
3. Victim client parses the message and certificate
4. Heap overflow occurs leading to memory corruption and code execution

How to detect it

Search email server and client logs for processing of S/MIME messages with DSA or RSA-PSS certificates around the time of any anomalous crashes or unexpected code execution.

What your security team should do

• Immediately apply the listed Git commit upgrades across all deployments
• Monitor for any new exploit code given the high CVSS score
• Review email handling configurations to limit S/MIME processing where possible until patched