CVE-2026-92240 describes an out-of-bounds read in Thunderbird's IMAP response parser triggered by a malicious or compromised IMAP server sending an untagged '* ID' response. This vulnerability can cause Thunderbird to crash and is reachable before authentication. The flaw was addressed and fixed in Thunderbird versions 156 and 140.16. The vendor advisory notes that exploitation via email is unlikely due to disabled scripting in mail reading, but potential risks remain in browser-like environments.

The vulnerability can cause Thunderbird to crash when connecting to a malicious or compromised IMAP server that sends a specially crafted untagged '* ID' response. Since the affected code path is reachable before authentication, it could disrupt client availability. However, exploitation through normal email reading is unlikely because scripting is disabled in Thunderbird's mail reading context. The impact is classified as low by the vendor.

This vulnerability is fixed in Thunderbird versions 156 and 140.16. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required as the flaw cannot generally be exploited through email in Thunderbird due to disabled scripting. For environments involving browser or browser-like contexts, caution is advised.