CVE-2026-4371 is an out-of-bounds read vulnerability in the IMAP parsing component of Mozilla Thunderbird. A malicious mail server can send malformed strings with negative lengths, causing the parser to read memory outside the allocated buffer. This memory safety issue can cause Thunderbird to crash or leak sensitive information. The vulnerability was addressed and fixed in Thunderbird versions 140.9 and 149. Mozilla's advisory emphasizes that exploitation via email is generally not feasible due to disabled scripting in mail reading, but the risk persists in browser-like environments. The CVSS v3.1 base score is 7.4, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity impact but high availability impact.

If exploited, this vulnerability can cause Thunderbird to crash (denial of service) or leak sensitive memory contents, potentially exposing confidential information. The attack requires control or compromise of a mail server or the connection to it. Because scripting is disabled in Thunderbird's mail reading context, direct exploitation through email is unlikely, but risks exist in browser or browser-like contexts. The vulnerability has a CVSS score of 7.4 (high severity), indicating significant impact on confidentiality and availability.

A fix is available and users should upgrade to Thunderbird version 140.9 or later, including version 149 where the vulnerability is also fixed. Mozilla's official advisories confirm these versions contain the patch. Since this is a client-side vulnerability triggered by malicious mail servers, upgrading Thunderbird to a fixed version is the primary mitigation. No additional vendor-recommended mitigations or workarounds are indicated. There are no known exploits in the wild at this time.