{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110247", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2026-10-13T18:08:37.322Z", "datePublished": "2026-10-13T18:08:37.608Z", "dateUpdated": "2026-10-13T18:10:20.644Z"}, "containers": {"cna": {"affected": [{"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "158", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."}]}], "title": "Integer overflow in libmime buffer growth could lead to heap corruption", "references": [{"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071621"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}], "credits": [{"lang": "en", "value": "Ahmed Albalawi"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-10-13T18:10:20.644Z"}}}}

{}

{"affected": [{"affectedData": [{"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "*", "status": "unaffected", "version": "158", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158."}], "id": "CVE-2026-110247", "lastModified": "2026-10-13T19:30:29.797", "metrics": {}, "published": "2026-10-13T19:18:49.493", "references": [{"source": "security@mozilla.org", "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2071621"}, {"source": "security@mozilla.org", "url": "https://www.mozilla.org/security/advisories/mfsa2026-109/"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "thunderbird: thunderbird: Arbitrary code execution via integer overflow in libmime", "id": "2550753", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550753"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["A flaw was found in Thunderbird. A remote attacker could exploit an integer overflow in the libmime library to achieve arbitrary code execution or cause a Denial of Service (DoS). By sending a sufficiently large email message, an attacker causes buffer size arithmetic to overflow without proper checks. This leads to heap memory corruption as subsequent memory copy operations overwrite adjacent heap allocations with attacker-controlled data."], "name": "CVE-2026-110247", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-10-13T18:08:37Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110247\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110247\nhttps://bugzilla.mozilla.org/show_bug.cgi?id=2071621\nhttps://www.mozilla.org/security/advisories/mfsa2026-109/"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[158,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Thunderbird", "source": "cna", "vendor": "Mozilla"}, "product": "thunderbird", "vendor": "mozilla"}], "created": "2026-10-13T19:45:18.466123+00:00", "updated": "2026-10-13T21:45:16.951923+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$thunderbird"], "weaknesses": ["CWE-119", "CWE-681", "CWE-20"]}