CVE-2026-57962
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Jul 1, 2026
CISA due date
—
The record
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | MozillaThunderbird | 0 | 140.12.1-1.1 |
Related vulnerabilities
- CVE-2026-57963 An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary… Also affects MozillaThunderbird
- CVE-2026-12324 Incorrect boundary conditions in the Graphics: CanvasWebGL component. Also affects MozillaThunderbird
- CVE-2026-12325 Denial-of-service in the Graphics: ImageLib component. Also affects MozillaThunderbird
- CVE-2026-12327 Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and… Also affects MozillaThunderbird
- CVE-2026-12330 Incorrect boundary conditions in the Internationalization component. Also affects MozillaThunderbird
- CVE-2026-12329 Memory safety bug fixed in Thunderbird ESR 140.12. Also affects MozillaThunderbird
- CVE-2026-12328 Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR… Also affects MozillaThunderbird
- CVE-2026-12315 Mitigation bypass in the DOM: Security component. Also affects MozillaThunderbird