CVE-2026-57962— Denial-of-service via malicious LDAP address-book server
Quick assessment
Affected
Mozilla Thunderbird
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mozilla thunderbird是Mozilla基金会开源的一款跨平台电子邮件和新闻客户端。 Mozilla Thunderbird 140.12.1之前版本和152.0.1之前版本存在资源管理错误漏洞，该漏洞源于LDAP客户端存储恶意LDAP服务器提供的数据时，可能存储大量数据直到内存耗尽导致崩溃。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Mozilla | Thunderbird | 140.12.1≤ 140.* |
unaffected |
152.0.1≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57962
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Denial-of-service via malicious LDAP address-book server
Source: CVE Program / CVE List V5
Vulnerability Description
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Mozilla Thunderbird 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mozilla thunderbird是Mozilla基金会开源的一款跨平台电子邮件和新闻客户端。 Mozilla Thunderbird 140.12.1之前版本和152.0.1之前版本存在资源管理错误漏洞，该漏洞源于LDAP客户端存储恶意LDAP服务器提供的数据时，可能存储大量数据直到内存耗尽导致崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mozilla | Thunderbird | 140.12.1 ~ 140.* | - |
|
II. Public POCs for CVE-2026-57962
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57962
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57962 (2)
IV. Related Vulnerabilities
Same product: Thunderbird
-
CVE-2026-103500
Heap buffer overflow opening large email -
CVE-2026-100820
Privilege escalation in the Address Bar component -
CVE-2026-100818
Sandbox escape due to use-after-free in the Widget: Gtk comp -
CVE-2026-100817
Other issue in the JavaScript: WebAssembly component -
CVE-2026-100813
Invalid pointer in the JavaScript Engine: JIT component
Same vendor: Mozilla
-
CVE-2026-103500
Heap buffer overflow opening large email -
CVE-2026-100832
Use-after-free in the Graphics: Canvas2D component -
CVE-2026-100830
Mitigation bypass in the DOM: Navigation component -
CVE-2026-100831
Use-after-free in the DOM: UI Events & Focus Handling compon -
CVE-2026-100829
Mitigation bypass in the DOM: Security component
V. Comments for CVE-2026-57962
No comments yet