critical9.1
CVE-2026-92240
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbi…
Impact
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Thunderbird | before 140.16.0 from 141.0 before 153.3.0 from 154.0 before 156.0 |