CVE-2026-103500Medium· 6.1▾ SunlitAn attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
— → 8.8
none → high
8.8 → 6.1
high → medium
Last analysed / modified upstream
0.2% → 0.3%
An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
thunderbird < 140.17.0thunderbird >= 141.0, < 153.4.0thunderbird >= 154.0, < 157.0Upgrade past the affected range:
thunderbird 157.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100794Critical· 9.6Sandbox escape due to incorrect boundary conditions in the Internationalization component
CVE-2026-100788Critical· 9.8Invalid pointer in the JavaScript: WebAssembly component
CVE-2026-100792High· 7.1JIT miscompilation in the JavaScript: WebAssembly component
CVE-2026-100793Medium· 6.5JIT miscompilation in the JavaScript Engine component
CVE-2026-92239High· 8.1A maliciously constructed IMAP line could cause an out-of-bounds buffer read
CVE-2026-92240Critical· 9.1A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird