CVE-2026-103500
Fixed in a distro release EPSS <1%CVSS 6.3
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
Products: Mozilla Thunderbird
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | thunderbird | 1:140.17.0esr-1~deb12u1 |
| Debian 13 | thunderbird | 1:140.17.0esr-1~deb13u1 |
| Debian 14 | thunderbird | 1:153.4.0esr-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | MozillaThunderbird | 153.4.0-150400.13.6.1 |
| SUSE Linux Enterprise Workstation Extension 15 SP7 | MozillaThunderbird | 153.4.0-150400.13.6.1 |
| Ubuntu 22.04 LTS | thunderbird | no fix |
| Ubuntu 24.04 LTS | thunderbird | no fix |
| Ubuntu 26.04 LTS | thunderbird | no fix |
| Ubuntu 26.10 | thunderbird | no fix |
| openSUSE Tumbleweed | MozillaThunderbird | 153.4.0-1.1 |