CVE-2024-1936: Thunderbird Information Disclosure Flaw

CVE-2024-1936 Overview

CVE-2024-1936 affects Mozilla Thunderbird versions prior to 115.8.1. The flaw causes the encrypted subject of an email message to be incorrectly and permanently assigned to an arbitrary other email message inside Thunderbird's local cache. When a user replies to a contaminated message, the confidential subject from an unrelated encrypted email may be sent to a third party. The issue is classified under [CWE-922] Insecure Storage of Sensitive Information. While the Thunderbird update prevents future contamination, it does not automatically remove existing incorrect subject assignments stored on disk.

Critical Impact
Confidential subjects of encrypted email can leak to unintended recipients when users reply to cache-contaminated messages, breaking the confidentiality guarantees expected of S/MIME and OpenPGP encrypted mail.

Affected Products

Mozilla Thunderbird versions prior to 115.8.1
Debian GNU/Linux 10 (Buster) Thunderbird packages
Any downstream distribution shipping Thunderbird earlier than 115.8.1

Discovery Timeline

2024-03-04 - CVE-2024-1936 published to NVD
2025-06-30 - Last updated in NVD database

Technical Details for CVE-2024-1936

Vulnerability Analysis

Thunderbird stores message metadata, including subjects, in a local cache to support fast folder display and search. For encrypted messages, the subject line is protected inside the encrypted body and is decrypted at runtime before being associated with the cached message record. The vulnerability stems from incorrect association logic that can permanently bind a decrypted subject to the wrong message identifier in this local store.

Once the cache is contaminated, the wrong subject persists across Thunderbird sessions. The visual appearance of folders therefore differs from the actual on-wire content of stored messages. When the user clicks Reply, Thunderbird quotes the cached subject in the outgoing message header. If the new recipient is not the original encrypted message's recipient, confidential subject material is disclosed in cleartext.

The vulnerability is tracked as [CWE-922] Insecure Storage of Sensitive Information. No working public exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The defect lies in how Thunderbird's message database links decrypted subjects to message records during cache population. An indexing or assignment error causes the decrypted subject from one encrypted message to be written against a different message's database entry. The assignment is persisted to disk, so the contamination survives client restarts and is not corrected by re-reading the underlying mail store.

Attack Vector

Exploitation requires a victim to process specially structured encrypted email content with a vulnerable Thunderbird client, then take an action such as replying or forwarding. The attack vector is network-based but requires user interaction, and attack complexity is high because the attacker must influence which subjects get cross-assigned within the local cache. Successful triggering causes the user to unknowingly disclose confidential encrypted subjects to attacker-controlled or unrelated third-party recipients.

No verified proof-of-concept code has been published. Technical specifics are tracked in Mozilla Bug Report #1860977 and Mozilla Security Advisory MFSA-2024-11.

Detection Methods for CVE-2024-1936

Indicators of Compromise

Thunderbird folders displaying subject lines that do not match the actual decrypted content of the underlying message when opened
Outbound replies whose Subject: header references encrypted correspondence with an unrelated party
Recipient complaints about unexpected or sensitive subjects appearing in replies received from an internal user

Detection Strategies

Inventory all endpoints running Mozilla Thunderbird and flag any installation reporting a version below 115.8.1
Audit Linux package managers for thunderbird package versions on Debian-based fleets, including Debian 10 LTS systems
Review outbound mail gateway logs for replies originating from Thunderbird users where subject lines reference encrypted threads

Monitoring Recommendations

Track Thunderbird version telemetry through endpoint management tooling and alert on installations that remain below the patched release
Monitor user reports of mismatched subject lines in encrypted mail folders as a behavioral signal of cache contamination
Correlate DLP events on outbound mail with Thunderbird process activity to identify potential subject leakage in replies

How to Mitigate CVE-2024-1936

Immediate Actions Required

Upgrade all Thunderbird installations to version 115.8.1 or later across managed endpoints
Instruct users of encrypted email to run the Repair Folder function from the context menu of each email folder containing encrypted messages
On Debian 10 systems, apply the Thunderbird security update referenced in the Debian LTS Security Announcement
Advise users to verify the subject line of any encrypted reply before sending until folder repair has been completed

Patch Information

Mozilla fixed the issue in Thunderbird 115.8.1. Patch details are published in Mozilla Security Advisory MFSA-2024-11, with the underlying defect tracked in Mozilla Bug Report #1860977. The update prevents new contamination but does not automatically rewrite existing cached subjects, so administrators must combine the patch with the Repair Folder workflow to remove residual incorrect assignments.

Workarounds

Use the Repair Folder option from each email folder's context menu to erase incorrect cached subject assignments after patching
Disable client-side caching of encrypted message metadata where supported by policy, accepting reduced performance in exchange for accuracy
Restrict reply and forward actions on encrypted folders pending verification that subjects match decrypted message content

bash

# Debian/Ubuntu: update Thunderbird to a patched release
sudo apt-get update
sudo apt-get install --only-upgrade thunderbird

# Verify the installed version is 115.8.1 or later
thunderbird --version