CVE-2026-14899 is an off-by-one out-of-bounds read vulnerability in Thunderbird's MIME header parser that occurs when forwarding a message if the setting to view all headers is enabled. This error allows reading a single byte beyond the allocated buffer, potentially leading to application crashes. Due to Thunderbird's design disabling scripting in mail reading contexts, exploitation through email is generally not feasible. The vulnerability was addressed and fixed in Thunderbird 153 and Thunderbird 140.13.

The vulnerability allows a single byte to be read beyond the MIME header buffer, which can cause Thunderbird to crash. There is no evidence of remote code execution or data disclosure from this flaw. Exploitation via email is unlikely because scripting is disabled when reading mail. The impact is therefore limited to potential denial of service (application crash).

This vulnerability has been fixed in Thunderbird versions 153 and 140.13. Users should update to these or later versions to remediate the issue. Since scripting is disabled when reading mail, the risk of exploitation through email is low. No additional mitigation actions are required beyond applying the official update.