The vulnerability CVE-2026-14899 in Mozilla Thunderbird involves an off-by-one error in the MIME header parser used when forwarding messages with the 'view all headers' setting enabled. This error permits reading one byte beyond the allocated buffer, which can lead to application crashes. The issue affects Thunderbird versions prior to 140.13 and prior to 153, with fixes applied in these versions. While exploitation via email is unlikely due to disabled scripting in mail reading, the vulnerability could pose risks in browser-like environments. The vendor advisory confirms the fix and rates the impact as moderate for this specific flaw, with an overall high severity rating due to the potential confidentiality impact. The vendor advisory also notes no known exploits in the wild and includes references to related security fixes in the same Thunderbird releases.

The vulnerability allows an off-by-one out-of-bounds read of memory, which can cause Thunderbird to crash, impacting availability. The CVSS vector indicates a network attack vector with low attack complexity, no privileges or user interaction required, and a confidentiality impact rated as high. However, exploitation through email is generally not possible because scripting is disabled when reading mail in Thunderbird. The impact is therefore limited primarily to potential application crashes and possible information disclosure in browser-like contexts. No known exploits are currently reported in the wild.

This vulnerability is fixed in Mozilla Thunderbird versions 140.13 and 153. Users and administrators should upgrade to at least Thunderbird 140.13 or 153 to remediate this issue. The vendor advisory states that these flaws cannot generally be exploited through email in Thunderbird due to disabled scripting, but the fix should still be applied to eliminate the risk. No additional mitigation actions are required beyond applying the official updates.