CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding
An off-by-one error in Thunderbird's MIME header parser allows a single byte out-of-bounds read, potentially crashing the application when viewing all headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-14899?
CVE-2026-14899 is a high-severity memory corruption vulnerability in Mozilla Thunderbird, published on 22 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.
Weakness: CWE-193
Which versions are affected by CVE-2026-14899?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2026-14899?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-14899 being exploited?
There is no known exploitation of CVE-2026-14899 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2026-14899, GHSA-6667-m7mf-jcr7, UBUNTU-CVE-2026-14899.