CVE-2026-103500
Mozilla Thunderbird: out-of-bounds write
- Risk score
- 41/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 30 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
- Affected
- Mozilla Thunderbird
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.1 medium
References
Original description
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
Last activity 30 Sep 2026. Patch Forecast updates every hour.