CVE-2026-57962: Thunderbird LDAP Memory Exhaustion Denial-of-Service

Technical summary

CVE-2026-57962 is a resource exhaustion vulnerability in Thunderbird's LDAP address-book integration. When Thunderbird queries an LDAP server for contact autocomplete suggestions, it does not properly validate or limit the size of responses received. A malicious LDAP endpoint can send arbitrarily large data payloads that Thunderbird caches in memory without bounds, eventually triggering an out-of-memory condition and application crash. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption), reflecting the lack of input validation on response size. The CVSS v3.1 score of 5.3 (MEDIUM) reflects the requirement for user interaction and high attack complexity, but acknowledges the impact on availability.

Business impact

For organizations relying on Thunderbird as a mail client, this vulnerability could cause intermittent service disruptions if users are directed to or configured with malicious LDAP servers. The risk is primarily operational: affected users lose email access until they restart Thunderbird. In environments where LDAP address books are centrally managed, a compromised or rogue LDAP server could be weaponized to target multiple users simultaneously, degrading productivity. However, the attack requires either network access to an LDAP server or a network position to intercept LDAP queries, limiting the threat model to targeted scenarios rather than mass exploitation.

Affected systems

Thunderbird versions prior to 152.0.1 and 140.12.1 are affected. Both the current and extended-support release branches had independent fixes: users on the 152.x line should update to 152.0.1 or later; users on the 140.x ESR line should update to 140.12.1 or later. Any Thunderbird installation configured to use an external LDAP server for address-book autocomplete is at risk if that server is compromised or untrusted. Installations using only local address books or non-LDAP directory sources are not affected.

Exploitability

Exploitation requires a specific configuration: the victim must have an LDAP server configured in Thunderbird's address-book settings. An attacker must then either compromise that LDAP server, operate a malicious LDAP server the victim is directed to use, or position themselves on the network path between Thunderbird and the LDAP server. User interaction is necessary in the sense that the victim must perform an action triggering an LDAP query (typically typing in a recipient field to trigger autocomplete). The vulnerability is not trivially exploitable in random environments, but is practical in targeted supply-chain or internal-network attacks. No known public exploit code exists, and the vulnerability has not been assigned to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Thunderbird to version 152.0.1 or later if running the current release branch, or 140.12.1 or later if running the ESR branch. Both fixes address the memory exhaustion issue by implementing proper validation and limits on LDAP response sizes. Organizations should verify their Thunderbird deployment policy and push these updates through their configuration management tools. As a temporary mitigation pending patching, disabling LDAP address-book lookups in Thunderbird's settings will prevent the attack vector, though this may reduce usability.

Patch guidance

Apply patches through Thunderbird's built-in update mechanism or your organization's software distribution system. For ESR users, confirm your current version against the 140.x line and update to 140.12.1 or a later 140.x release. For non-ESR users, update to 152.0.1 or later. Verify successful patching by checking Thunderbird's About dialog. No manual configuration changes are required after patching; the fix is transparent to end users. If you operate or manage internal LDAP servers used by Thunderbird clients, consider validating those servers are properly secured and not compromised.

Detection guidance

Monitor Thunderbird process logs or endpoint telemetry for repeated crashes or sudden terminations coinciding with LDAP queries. Examine LDAP server access logs for unusually large response payloads or repeated queries from specific Thunderbird clients. Network detection should focus on identifying LDAP responses exceeding typical sizes (baseline varies by organization, but responses >1 MB for address-book queries warrant investigation). If your LDAP infrastructure is under your control, implement rate limiting and response size caps at the server level. Endpoint detection platforms can flag Thunderbird out-of-memory crashes as potential indicators, though this is a symptom rather than a root-cause signal.

Why prioritize this

This vulnerability should be addressed promptly but does not demand emergency response. The MEDIUM severity reflects limited exploitability in the general case, but the practical impact on user productivity and the ease of exploitation in targeted scenarios—particularly within organizations managing centralized LDAP—justify scheduling updates within normal patch cycles. Prioritize patching systems where LDAP address-book integration is actively used. Systems without LDAP configured can be deprioritized but should not be deferred indefinitely.

Risk score, explained

The CVSS v3.1 score of 5.3 reflects: (1) Network-accessible attack vector, (2) High attack complexity due to the requirement for specific Thunderbird configuration and user interaction, (3) No privileges required, (4) User interaction required (triggering autocomplete), (5) No impact on confidentiality or integrity, but High impact on availability through denial of service. The score appropriately captures that while widespread exploitation is unlikely, targeted attacks against configured environments are feasible and impactful.

Frequently asked questions