CVE-2026-57962

5.3 Moyenne

Publiée le 01/07/2026 à 04:17 · Modifiée le 06/07/2026 à 17:21 · Analysée par le NVD · Source : security@mozilla.org

Description

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.

Traduire en français

Produits concernés

Mozilla Thunderbird

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.3 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

https://bugzilla.mozilla.org/show_bug.cgi?id=2042872 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-63/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-64/ Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories