Thunderbird <140.16 OOB Read in IMAP Parser via * ID Response
CVE-2026-92240 Published on September 15, 2026
Out-of-bounds read in IMAP response parser
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156 and Thunderbird 140.16.
Products Associated with CVE-2026-92240
Want to know whenever a new CVE is published for Mozilla Thunderbird? stack.watch will email you.
Affected Versions
Mozilla Thunderbird:- Version 140.16, <= 140.* is unaffected.
- Version 156, <= * is unaffected.