CVE-2022-0566

What it actually does

Out-of-bounds write of one byte during processing of a crafted email message, resulting in memory corruption.

Why it matters to the business

Attackers can potentially execute arbitrary code or cause denial of service on systems using the affected email client, leading to data breaches or operational disruption; the vulnerability is over three years old with low exploit probability and no known ransomware use.

How an attack unfolds

An attacker crafts a malicious email message designed to trigger the out-of-bounds write when processed by the vulnerable client; the message is delivered via standard email channels and executed upon opening or preview.

How to fix it

Upgrade Thunderbird to version 91.6.1 or later; apply the listed XWiki GIT fixes (fc77f9f53bc65a4a9bfae3d5686615309c0c76cc and 479a47aeb015f634a121f1821642e0cb61dcc3d7) where applicable in dependent components.

How to confirm the fix worked

Confirm client version is at or above the fixed release; test with crafted email samples in a controlled environment to verify absence of the memory write condition.

Typical attack path

1. Craft malicious email exploiting the one-byte OOB write
2. Deliver email to target user
3. User opens or previews the message in the vulnerable client
4. Memory corruption occurs enabling further exploitation

How to detect it

Review email server logs and client crash reports for unusual message processing events around the publication date; look for signs of memory-related errors in Thunderbird process dumps.

What your security team should do

• Prioritize patching all instances of the affected email client to the fixed version
• Monitor EPSS trend for any increase indicating rising exploit likelihood
• Review email filtering rules to block suspicious messages pending updates