CVE-2026-92240
UnknownSummary
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
Risk Assessment
An attacker controlling an IMAP server can remotely crash the mail client without authentication, potentially disrupting users or serving as part of a more complex attack. The out-of-bounds read could potentially leak process memory data.
Recommendation
Update Thunderbird to version 156 or 140.16 (or later). Until patched, avoid connecting to untrusted IMAP servers.
Other vulnerabilities in Thunderbird
See all- CVE-2026-92239Unknown
A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
- CVE-2026-92238Unknown
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
- CVE-2026-84639Critical
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84637Critical
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.
- CVE-2026-84143Critical
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84142Critical
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
- CVE-2026-74990Critical
Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
- CVE-2026-74989Critical
Internally found bugs in Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154 and Thunderbird 154.
- CVE-2026-74988Critical
Internally found bugs in Thunderbird ESR 153.0 and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
- CVE-2026-74987Critical
Internally found bugs in Thunderbird ESR 140.13, Thunderbird ESR 153.0, and Thunderbird 153 showed evidence of memory corruption or another security-relevant defect. Fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
Original NVD description (English source)
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.