CVE-2026-14899
Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Thunderbird MIME Header Parsing

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: Mozilla Corporation

Description
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-23
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-14899
EUVD
EUVD-2026-47773

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mozilla thunderbird to 153 (exc)
mozilla thunderbird 153
mozilla thunderbird 140.13

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-14899 is a moderate-severity vulnerability in Thunderbird caused by an off-by-one error in the MIME header parser. When forwarding a message with all headers enabled, it reads one extra byte beyond the allocated memory buffer for headers, potentially crashing Thunderbird.

Detection Guidance

This vulnerability is specific to Thunderbird versions 140.13 and earlier, and 152 and earlier. Detection involves checking the installed Thunderbird version. Use commands like 'thunderbird --version' on Linux or check 'Help > About Thunderbird' on any OS. If the version is 140.13 or below, or 152 or below, the system is vulnerable.

Impact Analysis

This vulnerability could cause Thunderbird to crash when forwarding messages with all headers enabled. However, exploitation through email is unlikely due to scripting being disabled in Thunderbird's mail reading mode. It poses a risk in browser-like contexts.

Mitigation Strategies

Update Thunderbird to version 153 or 140.13 or later immediately. Disable the option to view all headers when forwarding messages as a temporary workaround. Restart Thunderbird after updating to ensure the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart