Off-by-one in Mozilla Thunderbird - CVE-2026-14899

Vulnerability identifier: #VU139188

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-14899

CWE-ID: CWE-193

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an off-by-one error within the MIME header parser. A remote attacker can trick the victim into opening a specially crafted email and read contents of memory on the system or crash the application.

Mozilla Thunderbird
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
SUSE Package Hub 15
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
thunderbird (Debian package)
thunderbird
thunderbird-debuginfo
thunderbird-debugsource
thunderbird-librnp-rnp
thunderbird-wayland
thunderbird (Red Hat package)
MozillaThunderbird-debuginfo
MozillaThunderbird
MozillaThunderbird-debugsource
MozillaThunderbird-translations-other
MozillaThunderbird-translations-common

Install updates from vendor's website.

Mozilla Thunderbird - addressed in versions 140.13.0, 153.0
thunderbird (Debian package) - update to 1:140.13.0esr-2~deb13u1
thunderbird - update to 140.13.0-1
thunderbird-debuginfo - update to 140.13.0-1
thunderbird-debugsource - update to 140.13.0-1
thunderbird-librnp-rnp - update to 140.13.0-1
thunderbird-wayland - update to 140.13.0-1
thunderbird (Red Hat package) - addressed in versions 140.13.0-1.el8_10, 140.13.0-1.el9_2, 140.13.0-1.el9_6, 140.13.0-1.el9_8, 140.13.0-1.el10_0, 140.13.0-1.el10_2
thunderbird - update to 140.13.0-1.0.1
MozillaThunderbird-debuginfo - update to 140.13.0-150200.8.280.1
MozillaThunderbird - update to 140.13.0-150200.8.280.1
MozillaThunderbird-debugsource - update to 140.13.0-150200.8.280.1
MozillaThunderbird-translations-other - update to 140.13.0-150200.8.280.1
MozillaThunderbird-translations-common - update to 140.13.0-150200.8.280.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2026-72/
• https://bugzilla.mozilla.org/show_bug.cgi?id=2046137

• Multiple vulnerabilities in Mozilla Thunderbird ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• openEuler 24.03 LTS SP3 update for thunderbird
• openEuler 24.03 LTS SP4 update for thunderbird
• Red Hat Enterprise Linux 10 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Debian update for thunderbird
• Anolis OS update for thunderbird
• SUSE update for MozillaThunderbird
• Red Hat Enterprise Linux 10 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird