CVE-2020-26970

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-09 · updated 2026-06-17
Weakness: CWE-787

Description

When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1.

Affected products

Mozilla Thunderbird: before 78.5.1 — fixed in 78.5.1

How to fix

Upgrade to a fixed version: Mozilla Thunderbird 78.5.1. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1677338
https://www.mozilla.org/security/advisories/mfsa2020-53/
https://bugzilla.mozilla.org/show_bug.cgi?id=1677338
https://www.mozilla.org/security/advisories/mfsa2020-53/

Get alerted when CVE-2020-26970 or the next vulnerability affects your stack