CVE-2026-110247: Vulnerability in Mozilla Thunderbird

The vulnerability involves several buffer-growth sites in Thunderbird's libmime component performing size arithmetic using 32-bit types without verifying for overflow. When processing sufficiently large messages, the growth guard could fail, or buffers could be reallocated to sizes smaller than necessary. This results in memcpy operations writing attacker-controlled data beyond the intended buffer boundaries into adjacent heap allocations. The vulnerability was addressed and fixed in Thunderbird version 158.

An attacker could exploit this vulnerability by crafting a sufficiently large message that triggers the flawed buffer size calculations, potentially causing memory corruption by overwriting adjacent heap memory with attacker-controlled data. This could lead to undefined behavior including crashes or code execution. However, no known exploits are reported in the wild at this time.

This vulnerability has been fixed in Thunderbird version 158. Users and administrators should upgrade to version 158 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.