External risk intelligence

Thunderbird Memory Corruption Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74990

This vulnerability affects Mozilla Thunderbird, which is a client-side desktop email application. Desktop applications are not internet-facing services, gateways, or web applications and do not provide a reachable attack surface in standard network deployments.

Memory Corruption

Mozilla Firefox

before 115.39.0116.0 to before 140.14.0141.0 to before 153.1.0before 140.14.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability discovered in certain versions of Mozilla Thunderbird, an email client. The issue stems from internal bugs that could potentially lead to memory corruption. While exploitation is considered difficult, the severity of the defect warrants attention. The primary concern is to confirm if our environment utilizes the affected software and if so, understand the exposure.

Internal bugs found in email client software.
Critical defect could lead to memory corruption.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach this vulnerability by sending a specially crafted email or visiting a malicious website. This could lead to memory corruption, enabling an attacker to compromise the integrity and confidentiality of the application.

No authentication required for access.
Triggered by opening email or visiting a site.
Risks include memory corruption and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the memory of affected Thunderbird clients, potentially leading to crashes or other unpredictable behavior. While direct data theft or unauthorized access is not explicitly described, memory corruption issues can sometimes be a precursor to more severe security compromises, particularly when exploited with significant effort.

User's email client memory.
Via crafted network content.
Application instability or crashes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Mozilla Thunderbird, a desktop email client. Ownership for addressing this issue likely rests with teams managing end-user computing environments, desktop application deployment, and endpoint security. The initial practical step is to identify all instances of the affected Thunderbird versions within the organization, confirm their reachability and criticality, and then ascertain the specific teams or individuals responsible for their management and remediation.

End-user computing and security teams own this.
Verify affected Thunderbird installations and reachability.
Plan and coordinate updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Mozilla Thunderbird?

Thunderbird is a free, open-source desktop application used for managing email, calendars, and contacts. It functions as a local client that runs on a user's computer rather than a central server, allowing people to organize multiple email accounts from a single interface.

How does CVE-2026-74990 cause memory corruption?

This vulnerability relates to CWE-119, which involves improper restriction of operations within memory boundaries. Essentially, the software fails to safely manage data in its memory space, allowing that data to be overwritten or accessed incorrectly. For CVE-2026-74990, this defect means the application may not handle complex incoming content predictably, potentially leading to instability or security-relevant errors.

Do I need to be logged into an account to trigger this bug?

No. The vulnerability does not require authentication to trigger. It is primarily activated by the application processing specifically formatted content, such as opening a crafted email or navigating to a malicious website through the client. Simply having the application running and processing external data is the mechanism for potential interaction, rather than needing an active session or specific user privileges.

Is this Thunderbird vulnerability an internet-facing risk?

Halo Surface Signal indicates this is unlikely. Because Thunderbird is a desktop-based email client, it does not typically act as an internet-facing service, gateway, or web server. It does not provide the same reachable attack surface as infrastructure components, though it still processes external network traffic when receiving emails or rendering web-based content.

What is the recommended first step for this CVE?

The most effective first step is to perform a software inventory to identify all systems running Thunderbird ESR 140.13, 153.0, or standard version 153. Once identified, coordinate with the teams that manage endpoint software and end-user devices to schedule an update to the patched versions—such as 153.1 or 140.14—to ensure the memory handling bugs are resolved.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.