CVE-2021-23991

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-06-24 · updated 2026-06-17

Description

If a Thunderbird user has previously imported Alice's OpenPGP key, and Alice has extended the validity period of her key, but Alice's updated key has not yet been imported, an attacker may send an email containing a crafted version of Alice's key with an invalid subkey, Thunderbird might subsequently attempt to use the invalid subkey, and will fail to send encrypted email to Alice. This vulnerability affects Thunderbird < 78.9.1.

Affected products

Mozilla Thunderbird: before 78.9.1 — fixed in 78.9.1

How to fix

Upgrade to a fixed version: Mozilla Thunderbird 78.9.1. Check the vendor advisory for mitigations.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1673240
https://www.mozilla.org/security/advisories/mfsa2021-13/
https://bugzilla.mozilla.org/show_bug.cgi?id=1673240
https://www.mozilla.org/security/advisories/mfsa2021-13/

Get alerted when CVE-2021-23991 or the next vulnerability affects your stack