CVE-2026-110247

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Thunderbird 158 Due to Unchecked Size Arithmetic

Publication date: 2026-10-13

Last updated on: 2026-10-27

Assigner: Mozilla Corporation

Description

Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-27

Generated

2026-11-08

AI Q&A

2026-10-14

EPSS Evaluated

2026-11-07

NVD

CVE-2026-110247

EUVD

EUVD-2026-99207

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	158

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability involves buffer growth in libmime where size calculations were done using 32-bit integers without checking for overflow. On large messages, this could cause the buffer to be allocated too small or fail to grow properly, leading to a memcpy writing attacker-controlled data into adjacent memory.

Detection Guidance

This vulnerability requires checking Thunderbird versions and analyzing memory corruption patterns. Use 'thunderbird --version' to verify if your version is below 158. No direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary code or crash the application by sending a specially crafted large message. This could lead to data theft, system compromise, or denial of service if the vulnerable software is used.

Compliance Impact

This vulnerability could lead to arbitrary code execution or data corruption due to heap overflow, which may result in unauthorized access to sensitive data. This could violate GDPR's data protection requirements or HIPAA's confidentiality rules if exploited.

Mitigation Strategies

Upgrade Thunderbird to version 158 or later immediately. Disable automatic loading of remote content in Thunderbird settings to reduce attack surface until patched.

Hi! I’m here to help you understand CVE-2026-110247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...