CVE-2026-4371
7.4
HIGH
CVSS 3.1
EPSS 0.06%
Description
A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.
How to fix CVE-2026-4371
To remediate CVE-2026-4371, upgrade the affected package to a fixed version below.
- —upgrade to 1:140.9.0esr-1~deb11u1 or later
Is CVE-2026-4371 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 1:140.9.0esr-1~deb11u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H |