A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade thunderbird | Oct 11, 2026 | Sep 23, 2026 |
| Amazon Linux Ami 2 | — | Upgrade thunderbird | Oct 19, 2026 | Oct 19, 2026 |
| Debian | — | Upgrade thunderbird | Sep 21, 2026 | Sep 1, 2026 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 153.2Upgrade to the latest version of Mozilla Thunderbird | Sep 1, 2026 | Sep 1, 2026 |
| Oracle_linux | — | Upgrade thunderbird | Oct 22, 2026 | Sep 1, 2026 |
| Redhat_linux | — | Upgrade thunderbird-debuginfoNo solution existsUpgrade thunderbird-debugsourceUpgrade thunderbird | Sep 3, 2026 | Sep 1, 2026 |
| Rocky_linux | — | Upgrade thunderbird-debuginfoUpgrade thunderbirdUpgrade thunderbird-debugsource | Sep 28, 2026 | Sep 25, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub