CVE-2026-14899: Mozilla Thunderbird

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

Affected products

• Mozilla Thunderbird: before 140.13.0 (fixed in 140.13.0)

Published 2026-07-22. Last modified 2026-08-12.