High severity8.1NVD Advisory· Published Sep 15, 2026· Updated Sep 24, 2026
CVE-2026-92239
CVE-2026-92239
Description
A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected products
4cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <140.16.0
- (no CPE)range: before 156, 140.x before 140.16, 153.x before 153.3
- osv-coords2 versions
< 140.16.0-1.1+ 1 more
- (no CPE)range: < 140.16.0-1.1
- (no CPE)range: < 140.16.0-1.el9_8.alma.1
Patches
Vulnerability mechanics
References
4- www.mozilla.org/security/advisories/mfsa2026-94/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-95/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-96/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.