The vulnerability CVE-2026-14899 in Mozilla Thunderbird is an off-by-one out-of-bounds read in the MIME header parser used when forwarding messages if the user has enabled viewing all headers. This bug permits reading one byte beyond the allocated buffer, which can lead to application crashes. Mozilla fixed this issue in Thunderbird 153 and Thunderbird 140.13. Due to Thunderbird's disabling of scripting when reading mail, exploitation via email is unlikely; however, the vulnerability may pose risks in browser or browser-like environments. The vendor advisory confirms the availability of official patches.

The vulnerability allows a single byte to be read beyond the buffer, which can cause Thunderbird to crash, resulting in a denial-of-service condition. There is no indication from the vendor advisory that this vulnerability leads to code execution or data disclosure. Exploitation through normal email usage is unlikely due to disabled scripting, but potential risks exist in browser-like contexts.

Official fixes are available in Thunderbird versions 153 and 140.13. Users and administrators should update to these versions or later to remediate this vulnerability. Since the vendor advisory states that exploitation through email is generally not possible and scripting is disabled, no additional mitigations are required beyond applying the official patches.