CVE-2026-4371
High · 7.4CVSS
7.4
EPSS
0.7%
Published
Mar 24, 2026
CISA due date
—
The record
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 15.6 | MozillaThunderbird | 0 | 140.9.0-150200.8.263.1 |
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.9.0-1.1 |
Related vulnerabilities
- CVE-2026-3889 Spoofing issue in Thunderbird. Also affects MozillaThunderbird
- CVE-2026-4716 Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. Also affects MozillaThunderbird
- CVE-2026-4718 Undefined behavior in the WebRTC: Signaling component. Also affects MozillaThunderbird
- CVE-2026-4713 Incorrect boundary conditions in the Graphics component. Also affects MozillaThunderbird
- CVE-2026-4714 Incorrect boundary conditions in the Audio/Video component. Also affects MozillaThunderbird
- CVE-2026-4717 Privilege escalation in the Netmonitor component. Also affects MozillaThunderbird
- CVE-2026-4711 Use-after-free in the Widget: Cocoa component. Also affects MozillaThunderbird
- CVE-2026-4720 Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and… Also affects MozillaThunderbird