PT-2026-27517 · Mozilla+1 · Thunderbird+1

Rintaro Kobayashi · Published 2026-03-24 · Updated 2026-04-17 · CVE-2026-4371

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 149 Thunderbird versions prior to 140.9

Description A specially crafted email could contain malformed strings with negative lengths, leading to a memory read outside of the intended buffer. Successful exploitation of this issue, potentially through a compromised mail server or connection, could cause Thunderbird to crash or leak sensitive data.

Recommendations Update Thunderbird to version 149 or later. Update Thunderbird to version 140.9 or later.

Fix

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

ALSA-2026:6188

ALSA-2026:6342

ALSA-2026:6917

CVE-2026-4371

OESA-2026-1993

OESA-2026-1994

OPENSUSE-SU-2026:10447-1

RHSA-2026:6188

RHSA-2026:6342

RHSA-2026:6917

RHSA-2026:8284

RHSA-2026:8285

RHSA-2026:8286

RHSA-2026:8287

RHSA-2026:8288

RHSA-2026:8289

RHSA-2026:8290

RHSA-2026:8315

RHSA-2026:8850

SUSE-SU-2026:1163-1

Affected Products

Rocky Linux

Thunderbird

References · 193

• https://nvd.nist.gov/vuln/detail/CVE-2026-4720 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4717 · Security Note
• https://mozilla.org/security/advisories/mfsa2026-24/#CVE-2026-4371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4712 · Security Note
• https://osv.dev/vulnerability/OESA-2026-1994 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1163-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4696 · Security Note
• https://errata.almalinux.org/9/ALSA-2026-6188.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4710 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-6917.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-4371 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4716 · Security Note
• https://errata.almalinux.org/8/ALSA-2026-6917.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4718 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-4371 · Vendor Advisory