CVE-2026-110249: Thunderbird SOAP Response DOS Vulnerability

CVE-2026-110249 Overview

CVE-2026-110249 is a denial-of-service vulnerability in Mozilla Thunderbird's Exchange server integration. A malicious, compromised, or man-in-the-middle (MITM)-controlled Exchange server can return a single well-formed SOAP response that keeps Thunderbird's main thread CPU-bound for seconds to hours. The condition is triggered by an element containing enough attributes to overwhelm attribute processing on the main UI thread. Mozilla fixed the issue in Thunderbird 158 and Thunderbird 153.5.

Critical Impact
A single SOAP response from a hostile Exchange endpoint can freeze the Thunderbird client, blocking mail workflow and user interaction until the attribute parsing completes or the client is terminated.

Affected Products

Mozilla Thunderbird versions prior to 158
Mozilla Thunderbird ESR versions prior to 153.5
Thunderbird clients configured against Microsoft Exchange via SOAP (EWS)

Discovery Timeline

2026-10-13 - CVE-2026-110249 published to NVD
2026-10-13 - Last updated in NVD database
Thunderbird 158 / 153.5 - Mozilla releases fixed builds per Mozilla Security Advisory MFSA-2026-109 and MFSA-2026-110

Technical Details for CVE-2026-110249

Vulnerability Analysis

The flaw sits in Thunderbird's handling of SOAP responses returned by Exchange Web Services (EWS). When the client parses a response element, it processes each attribute attached to that element on the main thread. An attacker-controlled server can emit a single element with an abnormally large attribute count. Parsing time scales poorly with attribute count, and the main thread blocks for the duration.

Because Thunderbird's UI, networking, and mail processing share the main thread, the client becomes unresponsive. The impact ranges from seconds of lag to multi-hour stalls, depending on attribute volume and host hardware. No memory corruption, code execution, or data disclosure is required for the attack to succeed. The behavior aligns with an algorithmic complexity denial-of-service pattern [CWE-407].

Root Cause

The root cause is unbounded attribute processing in the SOAP response parser used by the Exchange integration. The parser does not enforce a ceiling on attribute count per element and does not offload work from the main thread. A well-formed response therefore remains syntactically valid while being computationally hostile.

Attack Vector

Exploitation requires that Thunderbird speak SOAP to a server the attacker controls or can intercept. Three realistic positions enable the attack:

A malicious Exchange server that a victim configures or is coerced into configuring.
A legitimate Exchange server compromised by an adversary with response-tampering capability.
A MITM position on the network path, where TLS is absent, misconfigured, or stripped.

Once in place, the attacker returns a single crafted SOAP response. Thunderbird parses it, the main thread stalls, and the mail client becomes unusable for the targeted user until the parse completes or the process is killed. Technical details are tracked in Mozilla Bug Report #2077826.

Detection Methods for CVE-2026-110249

Indicators of Compromise

Thunderbird processes exhibiting sustained high CPU on a single thread immediately after an EWS SOAP request completes.
User-reported client freezes correlated with sync operations against an Exchange account.
Outbound HTTPS sessions to unexpected or newly configured Exchange endpoints returning oversized SOAP payloads.

Detection Strategies

Inventory Thunderbird installations and flag versions below 158 or 153.5 for prioritized review.
Inspect EWS response sizes at TLS-terminating proxies and alert on SOAP bodies that are disproportionately large relative to the request.
Correlate endpoint CPU-spike telemetry with network metadata showing an active EWS session.

Monitoring Recommendations

Monitor thunderbird.exe and thunderbird-bin process CPU time and thread-level utilization through endpoint telemetry.
Track Exchange account configuration changes in managed Thunderbird deployments.
Alert on client HTTPS flows to Exchange hosts that are not on an approved allowlist.

How to Mitigate CVE-2026-110249

Immediate Actions Required

Upgrade Thunderbird to version 158 or Thunderbird ESR 153.5 on all endpoints.
Audit Exchange account configurations and remove any pointing to untrusted servers.
Enforce strict TLS validation for all EWS traffic to eliminate MITM response tampering.

Patch Information

Mozilla addressed the vulnerability in Thunderbird 158 and Thunderbird 153.5. Deployment guidance is in Mozilla Security Advisory MFSA-2026-109 and Mozilla Security Advisory MFSA-2026-110. Managed environments should push the update through existing software distribution tooling and verify version compliance after rollout.

Workarounds

Restrict Thunderbird clients to Exchange servers on a known allowlist via network policy.
Require TLS with certificate pinning or strict chain validation on the path to Exchange endpoints.
Where feasible, disable the Exchange/EWS account type until patched builds are deployed.