Critical severity9.1NVD Advisory· Published Sep 15, 2026· Updated Sep 24, 2026
CVE-2026-92240
CVE-2026-92240
Description
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
Affected products
4cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*range: <140.16.0
- (no CPE)range: <156, <140.16, <153.3
- osv-coords2 versions
< 140.16.0-1.el9_8.alma.1+ 1 more
- (no CPE)range: < 140.16.0-1.el9_8.alma.1
- (no CPE)range: < 140.16.0-1.1
Patches
Vulnerability mechanics
References
4- www.mozilla.org/security/advisories/mfsa2026-94/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-95/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-96/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
0No linked articles in our index yet.