Unrated severityNVD Advisory· Published Sep 30, 2026· Updated Sep 30, 2026

CVE-2026-103500

Description

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.

Affected products

Mozilla Corporation/Thunderbirdllm-fuzzy
Range: >=140.17, <153.4, <157

Patches

Vulnerability mechanics

References

bugzilla.mozilla.org/show_bug.cginvd
www.mozilla.org/security/advisories/mfsa2026-101/nvd
www.mozilla.org/security/advisories/mfsa2026-102/nvd
www.mozilla.org/security/advisories/mfsa2026-103/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000