CVE-2026-14899CWE-193

CVE-2026-14899

High · published July 23, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-193 · Off-by-one Error
Published
2026-07-23T00:16Z
Affected products (1)
ProductVersionsFixed in
mozilla/thunderbird< 140.13.0140.13.0
References (3)
https://bugzilla.mozilla.org/show_bug.cgi?id=2046137 · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-71/ · [email protected]https://www.mozilla.org/security/advisories/mfsa2026-72/ · [email protected]
EPSS history
Timeline
  • 22 JUL 19:19Z
    Off-by-one out of bounds read in MIME header parser for forwarding
    cvelistv5