This vulnerability involves an out-of-bounds read in the IMAP response parser of Mozilla Thunderbird triggered by a specially crafted untagged '* ID' response from a malicious or compromised IMAP server. The affected code path is reachable prior to user authentication, potentially allowing a denial of service via application crash. The flaw was addressed and fixed in Thunderbird 140.16.

The vulnerability can cause Thunderbird to crash when processing a malicious IMAP server response, resulting in a denial of service. There is no indication of code execution or data compromise. The affected parsing occurs before authentication, but exploitation is limited to crashing the client. According to the vendor advisory, the impact is rated low.

A fix is available in Thunderbird version 140.16. Users and administrators should update to Thunderbird 140.16 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.