CVE-2026-7322
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Memory safety bugs were found in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0, showing evidence of memory corruption. With enough effort, these could have been exploited to run arbitrary code.
Risk Assessment
The risk for the organization is the potential for remote code execution, which could lead to data breaches or service disruption.
Recommendation
Immediately update Thunderbird to version 150.0.1 or 140.10.1, depending on the ESR branch in use.
Other vulnerabilities in Thunderbird
See all- CVE-2026-16361Critical
Memory safety bugs in Thunderbird ESR 140.12 that could allow arbitrary code execution. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
- CVE-2026-14899High
The MIME header parsing code in Thunderbird when forwarding a message (with the setting to view all headers enabled) has an off-by-one error, allowing a single byte to be read from memory after the header buffer, potentially crashing Thunderbird. Fixed in Thunderbird 153 and Thunderbird 140.13.
- CVE-2026-57963Medium
A vulnerability in Thunderbird allows an attacker to inject arbitrary styled content, phishing links, and CSS via HTML chat messages (Matrix or XMPP). This flaw was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
- CVE-2026-57962Medium
A malicious LDAP server configured for address-book autocomplete in Thunderbird can send arbitrarily large data to the LDAP client, causing memory exhaustion and a crash. The vulnerability is fixed in Thunderbird 152.0.1 and 140.12.1.
- CVE-2026-12329Medium
A memory safety bug was fixed in Thunderbird ESR 140.12. This vulnerability was also patched in Firefox ESR 140.12 and Thunderbird 140.12.
- CVE-2026-7324High
Memory safety bugs were found in Thunderbird 150.0.0, some showing evidence of memory corruption that could potentially be exploited to run arbitrary code. The vulnerability was fixed in version 150.0.1.
- CVE-2026-7323High
Memory safety bugs were present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption, which could potentially be exploited to run arbitrary code.
- CVE-2026-4371High
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data.
Original NVD description (English source)
Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.