CVE-2026-103500CWE-122CWE-787

CVE-2026-103500

Medium · published September 30, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
11.2
In the wild
Unconfirmed
What it is

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00214 · 11.2th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2026-09-30T22:18Z
Affected products (3)
ProductVersionsFixed in
mozilla/thunderbird< 140.17.0140.17.0
mozilla/thunderbird≥ 141.0, < 153.4.0153.4.0
mozilla/thunderbird≥ 154.0, < 157.0157.0
References (4)
https://bugzilla.mozilla.org/show_bug.cgi?id=2070267 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-101/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-102/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-103/ · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 17:15Z
    Heap buffer overflow opening large email
    cvelistv5