VDB
DEBIAN-CVE-2026-4371
DEBIAN-CVE-2026-4371
PUBLISHED
CVSS 7.400000095367432 HIGH
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | thunderbird | 1:128.13.0esr-1, 140.9.0, 140.9.0 |
| Debian:11 | thunderbird | 140.1.1, 1:128.10.0esr-1~deb11u1, 1:128.10.0esr-1~deb12u1 |
| Debian:12 | thunderbird | 110.0, *, * |
| Debian:14 | thunderbird | *, 140.3.0, 140.3.1 |
Exploit Intelligence
- mfsa2026-23.yml (github-poc)
Timeline
- Mar 24, 2026 CVE Published
- Apr 28, 2026 CVE Updated