CVE-2024-1936

What it actually does

The vulnerability causes an encrypted email subject to be incorrectly and permanently stored in the local message cache under a different email record, so that subsequent reply operations expose the original confidential subject in outbound messages.

Why it matters to the business

Organizations risk unintended disclosure of sensitive email subjects to third parties, which can lead to compliance violations, loss of confidential information, and reputational damage; the high CVSS reflects the potential for high-impact confidentiality and integrity breaches even though exploitation requires user interaction.

How an attack unfolds

An attacker crafts or forwards an email that triggers Thunderbird's cache handling logic for encrypted subjects; once the subject is misassigned in the victim's local cache, the victim replies to the contaminated message and inadvertently sends the confidential subject to the attacker or another party.

How to fix it

Upgrade Thunderbird to version 115.8.1 or later. After upgrading, run the Repair Folder operation from the context menu of each affected mail folder to clear existing cache contamination. No automatic remediation of prior contamination occurs.

How to confirm the fix worked

Confirm the installed Thunderbird version is 115.8.1 or newer; after repair-folder execution, inspect message cache files or perform test replies on previously contaminated folders to verify subjects are no longer misassigned.

Typical attack path

1. Attacker delivers an email message designed to exercise the encrypted-subject cache logic
2. Thunderbird stores the subject under an incorrect message record in the local cache
3. User opens the contaminated message and initiates a reply
4. The cached subject is inserted into the outbound message and sent to the unintended recipient

How to detect it

Review Thunderbird mail logs and cache directories for unexpected subject strings attached to unrelated message IDs; look for outbound messages that contain subject values originating from different threads.

What your security team should do

• Immediately upgrade all Thunderbird installations to 115.8.1 or later
• Instruct users to run Repair Folder on all email folders containing encrypted messages
• Monitor support channels for any reports of subject leakage after the update window