CVE-2026-110249 — Denial-of-service in the Exchange email component
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's mai…
Published: 2026-10-13 · CVSS: 8.6 · CVSS 3.1
A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7