An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Sep 30, 2026 · NIST NVD

   Detected

   An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

2. Oct 15, 2026 · NIST NVD

   Updated

   An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

Affected

• cpe mozilla/thunderbirdversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-103500

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-103500

  An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

  nvd.nist.gov

References

• Permissions Required · bugzilla.mozilla.org
• Vendor Advisory · mozilla.org
• Vendor Advisory · mozilla.org
• Vendor Advisory · mozilla.org