CVE-2026-57962: Mozilla Thunderbird

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

Affected products

• Mozilla Thunderbird: before 140.12.1 (fixed in 140.12.1); before 152.0.1 (fixed in 152.0.1)

Published 2026-07-01. Last modified 2026-07-06.