Uncontrolled Memory Allocation in Mozilla Thunderbird - CVE-2026-57962

Vulnerability identifier: #VU139184

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-57962

CWE-ID: CWE-789

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled memory allocation in the Thunderbird LDAP client when querying a malicious LDAP address-book server for autocomplete. A remote attacker can return arbitrarily large amounts of attacker-supplied data to cause a denial of service.

Mozilla Thunderbird
Debian Linux
openEuler
thunderbird
thunderbird-debuginfo
thunderbird-debugsource
thunderbird-librnp-rnp
thunderbird-wayland
thunderbird (Debian package)

Install security update from vendor's website.

Mozilla Thunderbird - addressed in versions 140.12.1, 152.0.1
thunderbird - update to 140.12.1-1
thunderbird-debuginfo - update to 140.12.1-1
thunderbird-debugsource - update to 140.12.1-1
thunderbird-librnp-rnp - update to 140.12.1-1
thunderbird-wayland - update to 140.12.1-1
thunderbird (Debian package) - update to 1:140.13.0esr-2~deb13u1

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-63/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2042872
• https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/

• Multiple vulnerabilities in Mozilla Thunderbird
• openEuler 24.03 LTS SP3 update for thunderbird
• openEuler 24.03 LTS SP4 update for thunderbird
• Debian update for thunderbird