VYPR
← All advisories
High severity7.3NVD Advisory· Published Apr 28, 2026· Updated Apr 30, 2026

CVE-2026-7323

CVE-2026-7323

Description

Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Memory safety bugs in Thunderbird ESR 140.10.0 and 150.0.0 could allow arbitrary code execution via memory corruption; fixed in 140.10.1 and 150.0.1.

Vulnerability

CVE-2026-7323 is a memory safety vulnerability affecting Thunderbird ESR 140. The bug was present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. The Mozilla Fuzzing Team, along with researchers Ryan Hunt and Steve Fink, identified evidence of memory corruption in these versions [1][2].

Exploitation

These flaws cannot be exploited through email in Thunderbird because scripting is disabled when reading mail. However, they are potentially exploitable in browser or browser-like contexts [1][2]. An attacker would need to convince a user to interact with malicious content in a context where scripting is enabled, such as viewing an HTML email with external content or using Thunderbird's built-in browser features.

Impact

If successfully exploited, an attacker could achieve arbitrary code execution on the affected system. The vulnerability is rated High severity with a CVSS v3 score of 7.3 [1][2].

Mitigation

Mozilla has fixed this vulnerability in Thunderbird 150.0.1 and Thunderbird ESR 140.10.1. Users should update to these versions or later to mitigate the risk [1][2][3][4].

References
  1. Security Vulnerabilities fixed in Thunderbird 150.0.1
  2. Security Vulnerabilities fixed in Thunderbird 140.10.1
  3. Security Vulnerabilities fixed in Firefox ESR 140.10.1
  4. Security Vulnerabilities fixed in Firefox 150.0.1

AI Insight generated on May 18, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

5
  • Mozilla Corporation/Firefox2 versions
    cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*+ 1 more
    • cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*range: <150.0.1
    • cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*range: <140.10.1
  • Mozilla Corporation/Thunderbird2 versions
    cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*+ 1 more
    • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*range: <150.0.1
    • cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*range: <140.10.1
  • Thunderbird/Thunderbirdllm-fuzzy
    Range: =150.0.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

23