The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Apr 3, 2026 | Mar 30, 2026 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade thunderbird | Mar 30, 2026 | Mar 30, 2026 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 140.9 | Mar 27, 2026 | Mar 24, 2026 |
| Oracle_linux | — | Upgrade thunderbird | Apr 1, 2026 | Mar 24, 2026 |
| Redhat_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbirdNo solution existsUpgrade thunderbird-debuginfo | Mar 31, 2026 | Mar 24, 2026 |
| Rocky_linux | — | Upgrade thunderbird-debugsourceUpgrade thunderbird-debuginfoUpgrade thunderbird | Apr 8, 2026 | Apr 7, 2026 |
| Suse | — | Upgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade MozillaThunderbird-translations-commonUpgrade MozillaThunderbird-openpgp-librnp | Apr 2, 2026 | Apr 1, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub