CVE-2026-92238: Ambiguous parsing of mail headers
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 156 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.3 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 156 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 140.16 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 153.3
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-92238
- CVE-2026-92239
- CVE-2026-92240
- CVE-2026-92005
- CVE-2026-92006
- CVE-2026-92007
- CVE-2026-92008
- CVE-2026-92009
- CVE-2026-92010
- CVE-2026-92011
- CVE-2026-92012
- CVE-2026-92013
- CVE-2026-92015
- CVE-2026-92034
- CVE-2026-92035
- CVE-2026-92016
- CVE-2026-92017
- CVE-2026-92018
- CVE-2026-92019
- CVE-2026-92020
- CVE-2026-92022
- CVE-2026-92023
- CVE-2026-92024
- CVE-2026-92025
- CVE-2026-92026
- CVE-2026-92036
- CVE-2026-92027
- CVE-2026-92028
- CVE-2026-92029
- CVE-2026-92037
- CVE-2026-92038
- CVE-2026-92039
- CVE-2026-92040
- CVE-2026-92041
- CVE-2026-92042
- CVE-2026-92043
- CVE-2026-92044
- CVE-2026-92045
- CVE-2026-92030
- CVE-2026-92046
- CVE-2026-92047
- CVE-2026-92048
- CVE-2026-92049
- CVE-2026-92050
- CVE-2026-92051
- CVE-2026-92052
- CVE-2026-92053
- CVE-2026-92054
- CVE-2026-92055
- CVE-2026-92056
- CVE-2026-92057
- CVE-2026-92031
- CVE-2026-92032
- CVE-2026-92058
- CVE-2026-92059
- CVE-2026-92060
- CVE-2026-92061
- CVE-2026-92062
- CVE-2026-92063
- CVE-2026-92064
- CVE-2026-92065
- CVE-2026-92066
- CVE-2026-92067
- CVE-2026-92068
- CVE-2026-92069
- CVE-2026-92070
- CVE-2026-92071
- CVE-2026-92072
- CVE-2026-92073
- CVE-2026-92074
- CVE-2026-92075
- CVE-2026-92076
- CVE-2026-92077
- CVE-2026-92078
- CVE-2026-92079
- CVE-2026-92014
- CVE-2026-92021
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to provide a maliciously constructed mail header that triggers ambiguous parsing.
Which Thunderbird release contains the fix?
The vulnerability was fixed in Thunderbird 140.16.