CVE WatchJul 15, 2026

CVE-2026-4371

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail

CVSS

7.4

High

EPSS

0.4%

p30

KEV

—

Exploit Today

0-100

Published: Mar 24, 2026 · Last modified: Jul 15, 2026 · CWE-126 · CWE-130

EPSS · 30d

0.4%EPSS · 30 days0.4%

2026-08-202026-09-17

Technical description

A malicious mail server could send malformed strings with negative lengths, causing the parser to read memory outside the buffer. If a mail server or connection to a mail server were compromised, an attacker could cause the parser to malfunction, potentially crashing Thunderbird or leaking sensitive data. This vulnerability was fixed in Thunderbird 149 and Thunderbird 140.9.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-252947.4 HIG

5.2%

——2Transient DOS while parsing frame during channel usage.1d CVE-2026-252847.3 HIG

1.3%

——0Information Disclosure when a pointer is reused after being deallocated.1d CVE-2026-252757.5 HIG

22.7%

——7Transient DOS when processing authentication frames with invalid FILS information element header lengths.1d CVE-2026-240817.4 HIG

5.2%

——2Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled.1d CVE-2026-240757.8 HIG

1.5%

——0Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions.1d CVE-2026-734557.5 HIG

40.1%

——12On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.2d