CVE-2026-92240

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.16 Thunderbird versions prior to 153.3 Thunderbird versions prior to 156

Description A malicious or compromised IMAP server can cause a crash in Thunderbird by sending an untagged '* ID' response. This triggers an out-of-bounds read in the IMAP response parser, which is a condition where the software reads data outside the intended boundary of a buffer. This issue is reachable before the user authenticates.

Recommendations Update to version 140.16 or later. Update to version 153.3 or later. Update to version 156 or later.