CVE-2026-103500

A flaw was found in Thunderbird. A remote attacker could exploit this vulnerability by convincing a user to open an email that is 2GB or larger, triggering a heap buffer overflow. This flaw allows an attacker to corrupt memory, which may cause an application crash, resulting in a Denial of Service (DoS), or potentially lead to arbitrary code execution.

Last checked: 2026-10-16 21:28 UTC

• No exploitation evidence · CISA Coordinator (Assessed 2026-10-16 18:33 UTC)

References

• NVD: CVE-2026-103500
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-15 17:56 UTC