CVE-2026-103500
EUVD-2026-9020030.09.2026, 18:18
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mozilla | thunderbird | 𝑥 < 140.17.0 |
| mozilla | thunderbird | 141.0 ≤ 𝑥 < 153.4.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| mozilla | thunderbird | 154.0 ≤ 𝑥 < 157.0 | CNA |
| mozilla | thunderbird_esr | 𝑥 < 140.17.0 | CNA |
| mozilla | thunderbird_esr | 141.0 ≤ 𝑥 < 153.4.0 | CNA |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| MozillaThunderbird |
| ||||||||
| MozillaThunderbird-translations-common |
| ||||||||
| MozillaThunderbird-translations-other |
|
Common Weakness Enumeration
- CWE-787 - Out-of-bounds WriteThe software writes data past the end, or before the beginning, of the intended buffer.
- CWE-122 - Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
Vulnerability Media Exposure