CVE-2026-110249

Awaiting Analysis Awaiting Analysis - Queue

Thunderbird Denial of Service via Malicious Exchange Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Mozilla Corporation

Description

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110249

EUVD

EUVD-2026-99208

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	158
mozilla	thunderbird	153.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allows a malicious or compromised Exchange server to send a specially crafted SOAP response with excessive attributes. This causes Thunderbird's main thread to become CPU-bound for extended periods, ranging from seconds to hours.

Detection Guidance

Detection involves checking Thunderbird version and monitoring for unusual CPU usage during Exchange server interactions. Verify installed version with 'thunderbird --version' or check 'Help > About Thunderbird'. Monitor system performance for sustained high CPU usage when connecting to Exchange servers.

Impact Analysis

If exploited, this vulnerability can severely degrade Thunderbird's performance, making the application unresponsive or crashing it. Users may experience system slowdowns or complete unavailability of Thunderbird while processing the malicious SOAP response.

Mitigation Strategies

Upgrade Thunderbird to version 158 or 153.5 immediately. Disable automatic updates temporarily if needed. Block or isolate untrusted Exchange servers. Monitor network traffic for suspicious SOAP responses. Consider using alternative email clients until patched.

Hi! I’m here to help you understand CVE-2026-110249. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70