Mozilla Thunderbird: Integer overflow in libmime leads to heap corruption
Summary
Several buffer-growth calculations in the libmime MIME parsing component of Mozilla Thunderbird use 32-bit arithmetic without overflow checks. On a sufficiently large message, the size guard can fail and a buffer can be allocated too small, so a later memcpy writes attacker-controlled data into adjacent heap memory. The CVSS vector assumes local access with no privileges and no user interaction, so the main exposure is Thunderbird clients that process incoming mail.
Affected
- Mozilla Thunderbird (exact affected range unknown; not confirmed from primary sources)
Fixed in
- Mozilla Thunderbird 158 (Mozilla advisory MFSA 2026-109)
- Mozilla Thunderbird 153.6: stated in the reference supplied, but not confirmed in the MFSA 2026-122 text retrieved; verify before relying on it
Workaround
- Unknown. No vendor-documented workaround found.
Exploitation
- No evidence of active exploitation; not marked as known exploited.
- No public proof of concept confirmed.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Update Thunderbird to 158 or later on all workstations, or to the fixed 153.6 build if you run that branch.
- Confirm the installed version on each device, especially unmanaged installs.
- Keep automatic updates enabled, and avoid opening mail from untrusted senders on unpatched clients until they are updated.
- Check your Linux distribution's advisory for fixed package builds.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Mozilla Foundation Security Advisory 2026-109 www.mozilla.org
- Mozilla Foundation Security Advisory 2026-122 www.mozilla.org
- Ubuntu CVE tracker: CVE-2026-110247 ubuntu.com
- Mozilla Bugzilla bug 2071621 bugzilla.mozilla.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:31.
Original description (NVD)
Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.