CVE-2026-57962

Analyzed Analyzed - Analysis Complete

Memory Exhaustion in Thunderbird LDAP Autocomplete

Publication date: 2026-07-01

Last updated on: 2026-07-06

Assigner: Mozilla Corporation

Description

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-06

Generated

2026-07-21

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-19

NVD

CVE-2026-57962

EUVD

EUVD-2026-40861

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 140.12.1 (exc)
mozilla	thunderbird	to 152.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves a malicious LDAP server that a Thunderbird user has configured for address-book autocomplete queries. The attacker can supply arbitrarily large amounts of data to the Thunderbird LDAP client, causing it to consume excessive memory and eventually crash due to memory exhaustion.

The issue was addressed and fixed in Thunderbird versions 152.0.1 and 140.12.1.

Detection Guidance

This vulnerability involves a malicious LDAP server sending excessively large amounts of data to the Thunderbird LDAP client, causing memory exhaustion and a crash.

To detect this vulnerability on your system or network, monitor Thunderbird LDAP client queries for unusually large or excessive data responses from LDAP servers configured for address-book autocomplete.

You can use network traffic analysis tools such as Wireshark or tcpdump to capture and inspect LDAP traffic for abnormal data sizes.

Use tcpdump to capture LDAP traffic on the default LDAP port (389): tcpdump -i <interface> port 389 -w ldap_traffic.pcap
Analyze the captured traffic with Wireshark to look for LDAP responses with unusually large payloads.
Monitor Thunderbird application logs or system logs for crashes or memory exhaustion events related to LDAP queries.

Additionally, ensure your Thunderbird client is updated to version 152.0.1 or later, where this vulnerability is fixed.

Impact Analysis

The primary impact of this vulnerability is that the Thunderbird email client can crash due to memory exhaustion when querying a malicious LDAP server. This can lead to denial of service, disrupting the user's ability to use the address-book autocomplete feature and potentially causing loss of unsaved data or interruption of workflow.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

To mitigate this vulnerability, update Thunderbird to version 152.0.1 or later, or Thunderbird 140.12.1 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-57962. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70