A critical vulnerability in Mozilla Thunderbird allows unauthenticated remote attackers to disclose sensitive heap memory, posing a significant risk to user data privacy.

This vulnerability is a use-after-free and memory disclosure flaw triggered by an unauthenticated attacker operating a malicious IMAP server. By sending a crafted ID response, the attacker can force the application to write heap contents into the configuration file, prefs.js.

The ability to disclose heap memory can lead to the exposure of sensitive information, including credentials, tokens, or other private data stored in the application memory. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to organizational data confidentiality, as it can be exploited remotely without user interaction.

Immediate Action: Upgrade to Mozilla Thunderbird version 140.15, 153.2, 155, or any later release to incorporate the necessary security patches.

Proactive Monitoring: Review application access logs for connections to untrusted or suspicious mail servers that might attempt to exploit IMAP protocol responses.

Compensating Controls: Ensure that Thunderbird is configured to block remote content and minimize connections to non-essential or untrusted mail servers where possible.

Public Exploit Available: Unknown.

This vulnerability presents a high risk due to the potential for unauthenticated remote memory disclosure. Security teams should prioritize the deployment of the provided Thunderbird updates across all client workstations immediately to prevent unauthorized access to sensitive memory contents.