CVE-2026-4371 is a memory safety vulnerability classified as CWE-126 (Buffer Over-read) in Mozilla Thunderbird's IMAP parser. It occurs when a malicious mail server sends malformed strings with negative lengths, causing the parser to read memory beyond the allocated buffer. This can cause application crashes or potential leakage of sensitive data. The vulnerability was addressed and fixed in Thunderbird versions 140.9 and 149. The Mozilla advisory notes that exploitation via email is generally not feasible due to disabled scripting in mail reading, but risks exist in browser-like contexts. The CVSS v3.1 score is 7.4 (High), reflecting network attack vector with high impact on confidentiality and availability but requiring high attack complexity and no privileges or user interaction.

If exploited, this vulnerability could cause Thunderbird to crash or leak sensitive information from memory. The attack requires control or compromise of a mail server or connection to it. Since scripting is disabled in Thunderbird's mail reading context, exploitation through normal email is unlikely, but browser-like contexts may be vulnerable. No known exploits in the wild have been reported. The impact is rated high due to potential confidentiality and availability effects.

Mozilla has released official fixes for this vulnerability in Thunderbird versions 140.9 and 149. Users and administrators should upgrade to one of these fixed versions to remediate the issue. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed as fixed in the specified versions.