{"id":"CVE-2026-110247","title":"Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks","summary":"Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a s…","severity":"none","published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T19:30:29.797","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110247","references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2071621","label":"security@mozilla.org"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-109/","label":"security@mozilla.org"}],"tags":["nvd"],"ingestedAt":"2026-10-13T19:43:28.944Z","slug":"CVE-2026-110247","body":"## Overview\n\nSeveral buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would then write attacker-controlled data across adjacent heap allocations. This vulnerability was fixed in Thunderbird 158.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}