CVE-2020-26970

8.8 highEPSS 1.2%

High (8.8) in mozilla thunderbird. EPSS 1.2% chance of exploitation in the next 30 days.

When reading SMTP server status codes, Thunderbird writes an integer value to a position on the stack that is intended to contain just one byte. Depending on processor architecture and stack layout, this leads to stack corruption that may be exploitable. This vulnerability affects Thunderbird < 78.5.1.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2020-12-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1677338
https://www.mozilla.org/security/advisories/mfsa2020-53/
https://bugzilla.mozilla.org/show_bug.cgi?id=1677338
https://www.mozilla.org/security/advisories/mfsa2020-53/

Check your stack JSON