CVE-2026-14899

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=2046137	Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-71/	Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-72/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El código para analizar encabezados MIME para mostrar al reenviar un mensaje (si la configuración para ver todos los encabezados estaba habilitada) tenía un error de off-by-one, permitiendo que se leyera un solo byte de la memoria después del búfer para los encabezados, y potencialmente bloqueando Thunderbird. Esta vulnerabilidad se corrigió en Thunderbird 153 y Thunderbird 140.13.

Information

Published : 2026-07-22 20:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-14899

Mitre link : CVE-2026-14899

CVE.ORG link : CVE-2026-14899

JSON object : View

Products Affected

mozilla

thunderbird

CWE

CWE-193

Off-by-one Error

{"id": "CVE-2026-14899", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14899", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:12:35.358996Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@mozilla.org", "affectedData": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "140.13", "versionType": "rpm", "lessThanOrEqual": "140.*"}, {"status": "unaffected", "version": "153", "versionType": "rpm", "lessThanOrEqual": "*"}]}]}], "published": "2026-07-22T20:16:48.383", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2046137", "tags": ["Permissions Required"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-71/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/", "tags": ["Vendor Advisory"], "source": "security@mozilla.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13."}, {"lang": "es", "value": "El c\u00f3digo para analizar encabezados MIME para mostrar al reenviar un mensaje (si la configuraci\u00f3n para ver todos los encabezados estaba habilitada) ten\u00eda un error de off-by-one, permitiendo que se leyera un solo byte de la memoria despu\u00e9s del b\u00fafer para los encabezados, y potencialmente bloqueando Thunderbird. Esta vulnerabilidad se corrigi\u00f3 en Thunderbird 153 y Thunderbird 140.13."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*", "vulnerable": true, "matchCriteriaId": "335C8DD1-16E6-484E-910B-AFBE76FCB370", "versionEndExcluding": "140.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@mozilla.org"}