Mozilla Thunderbird Out-of-Bounds Read Vulnerability in IMAP Parsing

A vulnerability exists in Mozilla Thunderbird versions prior to 149 and versions prior to 140.9. This issue allows a malicious mail server to send improperly formatted strings with negative lengths, which can cause the email parser to read memory outside of its allocated buffer. Such exploitation could lead to a parser malfunction, potentially crashing Thunderbird or causing a leak of sensitive information.

Impact

Exploitation of this vulnerability could result in a crash of the Thunderbird application or unauthorized disclosure of sensitive data.

Remediation

Users can upgrade to Thunderbird versions 149 or 140.9 to address this vulnerability.