CVE-2026-92240
published 2026-09-15CVE-2026-92240: A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing…
PriorityP351critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.63%
49.2th percentile
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 153.3 | Thunderbird 153.3 |
| mozilla | thunderbird | < Thunderbird 140.16 | Thunderbird 140.16 |
| mozilla | thunderbird | < Thunderbird 156 | Thunderbird 156 |
| mozilla | thunderbird | < 140.16.0 | 140.16.0 |
| mozilla | thunderbird | >= 141.0 < 153.3.0 | 153.3.0 |
| mozilla | thunderbird | >= 154.0 < 156.0 | 156.0 |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat3.4LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: Out-of-bounds read in IMAP response parser
vendor_redhat·2026-09-15·CVSS 3.4
CVE-2026-92240 [LOW] CWE-125 thunderbird: Out-of-bounds read in IMAP response parser
thunderbird: Out-of-bounds read in IMAP response parser
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
A malicious or compromised IMAP server can trigger an out-of-bounds read in
the IMAP response parser by sending an untagged '* ID' response, crashing
Thunderbird. The affected parsing path is reachable before authentication.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Mozilla
Mozilla Foundation Security Advisory 2026-96: CVE-2026-92240
vendor_mozilla
CVE-2026-92240 Mozilla Foundation Security Advisory 2026-96: CVE-2026-92240
Mozilla Foundation Security Advisory 2026-96
CVE: CVE-2026-92240
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.3
Mozilla
Mozilla Foundation Security Advisory 2026-95: CVE-2026-92240
vendor_mozilla
CVE-2026-92240 Mozilla Foundation Security Advisory 2026-95: CVE-2026-92240
Mozilla Foundation Security Advisory 2026-95
CVE: CVE-2026-92240
Product: Thunderbird
Impact: moderate
Fixed in: Thunderbird 140.16
Mozilla
Mozilla Foundation Security Advisory 2026-94: CVE-2026-92240
vendor_mozilla
CVE-2026-92240 Mozilla Foundation Security Advisory 2026-94: CVE-2026-92240
Mozilla Foundation Security Advisory 2026-94
CVE: CVE-2026-92240
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 156
GHSA
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird.
ghsa_unreviewed·2026-09-15
CVE-2026-92240 A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird.
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
No detection rules found.
No public exploits indexed.
2026-09-15
Published