CVE-2021-43529
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021...
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
CVE-2021-43529- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
CVE-2021-43529- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2021-30458
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
EUVD-2021-30458- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-82q7-2fg2-4gcj
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021...
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
GHSA-82q7-2fg2-4gcj- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
CVE-2021-43529- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-43529
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
DEBIAN-CVE-2021-43529- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVRHSA-2021:4130
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:4130- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4132
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:4132- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4133
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:4133- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:4134
Red Hat Security Advisory: thunderbird security update
- Record
RHSA-2021:4134- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2021:4130
Important: thunderbird security update
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 91.3.0.
Security Fix(es):
Mozilla: Use-after-free in HTTP2 Session object
Mozilla: Memory safety bugs fixed in Firefox 94 and Firefox ESR 91.3
Mozilla: iframe sandbox rules did not apply to XSLT stylesheets (CVE-2021-38503)
Mozilla: Use-after-free in file picker dialog (CVE-2021-38504)
Mozilla: Firefox could be coaxed into going into fullscreen mode without notification or warning (CVE-2021-38506)
Mozilla: Opportunistic Encryption in HTTP2 could be used to bypass the Same-Origin-Policy on services hosted on other ports (CVE-2021-38507)
Mozilla: Permission Prompt could be overlaid, resulting in user confusion and potential spoofing (CVE-2021-38508)
Mozilla: Javascript alert box could have been spoofed onto an arbitrary domain (CVE-2021-38509)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2021:4130- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-43529
Thunderbird versions prior to 91.3.0 are vulnerable to the heap overflow described in CVE-2021-43527 when processing S/MIME messages. Thunderbird versions 91.3.0 and later will not call the vulnerable code when processing S/MIME messages that contain certificates with DER-encoded DSA or RSA-PSS signatures.
- Record
UBUNTU-CVE-2021-43529- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 | before 1:91.3.0-1 | 1:91.3.0-1 |
thunderbirdDebian:13 | before 1:91.3.0-1 | 1:91.3.0-1 |
thunderbirdDebian:14 | before 1:91.3.0-1 | 1:91.3.0-1 |
thunderbirdDebian:9 From an advisory covering 24 CVEs | before 1:91.4.1-1~deb9u1, plus listed versions 1.5-41.5.0.2-11.5.0.2-21.5.0.2-31.5.0.4-1 Show 45 moreShow less1.5.0.4-21.5.0.4-31.5.0.5-11.5.0.7-11.5.0.7-21:52.4.0-11:52.4.0-1~deb7u11:52.4.0-1~deb8u11:52.4.0-1~deb9u11:52.4.0-2~exp11:52.5.0-11:52.5.0-1~deb7u11:52.5.0-1~deb8u11:52.5.0-1~deb9u11:52.5.2-11:52.5.2-1~deb7u11:52.5.2-21:52.5.2-2~deb8u11:52.5.2-2~deb9u11:52.6.0-11:52.6.0-1+alpha.11:52.6.0-1+alpha.21:52.6.0-1~deb7u11:52.6.0-1~deb8u11:52.6.0-1~deb9u11:52.7.0-11:52.7.0-1~deb7u11:52.7.0-1~deb8u11:52.7.0-1~deb9u11:52.8.0-11:52.8.0-1~deb7u11:52.8.0-1~deb8u11:52.8.0-1~deb9u11:52.9.0-11:52.9.1-11:52.9.1-1~deb8u11:52.9.1-1~deb9u11:58.0~b3-11:60.0-11:60.0-21:60.0-2~deb9u11:60.0-31:60.0-3~deb9u11:60.0~b10-11:60.0~b2-1 | 1:91.4.1-1~deb9u1 |
thunderbirdDebian:10 From an advisory covering 25 CVEs | before 1:91.4.1-1~deb10u1, plus listed versions 1:60.7.2-11:60.8.0-11:60.8.0-1~deb10u11:60.8.0-1~deb8u11:60.8.0-1~deb9u1 Show 45 moreShow less1:60.8.0-21:60.9.0-11:60.9.0-1~deb10u11:60.9.0-1~deb8u11:60.9.0-1~deb9u11:65.0~b1-11:66.0~b1-11:67.0~b3-11:68.0~b1-11:68.1.1-1~exp11:68.1.2-1~exp11:68.10.0-11:68.10.0-1~deb10u11:68.10.0-1~deb9u11:68.11.0-11:68.11.0-1~deb10u11:68.11.0-1~deb9u11:68.11.0-21:68.11.0-31:68.12.0-11:68.12.0-1~deb10u11:68.12.0-1~deb9u11:68.12.0-1~deb9u21:68.2.1-11:68.2.2-11:68.2.2-1~deb10u11:68.2.2-1~deb8u11:68.2.2-1~deb9u11:68.3.0-11:68.3.0-21:68.3.0-2~deb10u11:68.3.0-2~deb8u11:68.3.0-2~deb9u11:68.3.1-11:68.4.1-11:68.4.1-1~deb10u11:68.4.1-1~deb8u11:68.4.1-1~deb9u11:68.4.2-11:68.5.0-11:68.5.0-1~deb10u11:68.5.0-1~deb8u11:68.5.0-1~deb9u11:68.6.0-11:68.6.0-1~deb10u1 | 1:91.4.1-1~deb10u1 |
thunderbirdDebian:11 From an advisory covering 25 CVEs | before 1:91.4.1-1~deb11u1, plus listed versions 1:78.12.0-11:78.13.0-11:78.13.0-1~deb10u11:78.13.0-1~deb11u11:78.13.0-1~deb9u1 Show 24 moreShow less1:78.14.0-11:78.14.0-1~deb10u11:78.14.0-1~deb11u11:78.14.0-1~deb9u11:84.0~b3-11:85.0~b3-11:86.0~b3-11:88.0~b2-11:89.0~b2-11:90.0~b2-11:91.0-11:91.0.2-11:91.0~b1-11:91.0~b3-11:91.0~b5-11:91.1.0-11:91.1.1-11:91.2.0-11:91.2.1-11:91.3.0-11:91.3.2-11:91.4.0-11:91.4.1-1~deb10u11:91.4.1-1~deb9u1 | 1:91.4.1-1~deb11u1 |
thunderbirdRed Hat:enterprise_linux:8::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_4 | 0:91.3.0-2.el8_4 |
thunderbird-debuginfoRed Hat:enterprise_linux:8::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_4 | 0:91.3.0-2.el8_4 |
thunderbird-debugsourceRed Hat:enterprise_linux:8::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_4 | 0:91.3.0-2.el8_4 |
thunderbirdRed Hat:rhel_eus:8.2::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_2 | 0:91.3.0-2.el8_2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thunderbird-debuginfoRed Hat:rhel_eus:8.2::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_2 | 0:91.3.0-2.el8_2 |
thunderbird-debugsourceRed Hat:rhel_eus:8.2::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_2 | 0:91.3.0-2.el8_2 |
thunderbirdRed Hat:rhel_eus:8.1::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_1 | 0:91.3.0-2.el8_1 |
thunderbird-debuginfoRed Hat:rhel_eus:8.1::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_1 | 0:91.3.0-2.el8_1 |
thunderbird-debugsourceRed Hat:rhel_eus:8.1::appstream From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_1 | 0:91.3.0-2.el8_1 |
thunderbirdRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::client From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbirdRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::server From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbirdRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbird-debuginfoRed Hat:enterprise_linux:7::workstation From an advisory covering 9 CVEs | before 0:91.3.0-2.el7_9 | 0:91.3.0-2.el7_9 |
thunderbirdRocky Linux:8 From an advisory covering 9 CVEs | before 0:91.3.0-2.el8_4 | 0:91.3.0-2.el8_4 |
thunderbirdRocky Linux:8 From an advisory covering 9 CVEs | before 0:91.3.0-2.el8 | 0:91.3.0-2.el8 |
thunderbirdUbuntu:18.04:LTS | before 1:91.5.0+build1-0ubuntu0.18.04.1, plus listed versions 1:52.4.0+build1-0ubuntu21:52.6.0+build1-0ubuntu11:52.7.0+build1-0ubuntu11:52.8.0+build1-0ubuntu0.18.04.11:52.9.1+build3-0ubuntu0.18.04.1 Show 20 moreShow less1:60.2.1+build1-0ubuntu0.18.04.21:60.4.0+build2-0ubuntu0.18.04.11:60.5.1+build2-0ubuntu0.18.04.11:60.6.1+build2-0ubuntu0.18.04.11:60.7.0+build1-0ubuntu0.18.04.11:60.7.1+build1-0ubuntu0.18.04.11:60.7.2+build2-0ubuntu0.18.04.11:60.8.0+build1-0ubuntu0.18.04.11:60.9.0+build1-0ubuntu0.18.04.11:68.2.1+build1-0ubuntu0.18.04.11:68.2.2+build1-0ubuntu0.18.04.11:68.4.1+build1-0ubuntu0.18.04.11:68.7.0+build1-0ubuntu0.18.04.11:68.8.0+build2-0ubuntu0.18.04.21:68.10.0+build1-0ubuntu0.18.04.11:78.8.1+build1-0ubuntu0.18.04.11:78.11.0+build1-0ubuntu0.18.04.21:78.13.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.11:78.14.0+build1-0ubuntu0.18.04.2 | 1:91.5.0+build1-0ubuntu0.18.04.1 |
thunderbirdUbuntu:20.04:LTS | before 1:91.5.0+build1-0ubuntu0.20.04.1, plus listed versions 1:68.1.2+build1-0ubuntu11:68.1.2+build1-0ubuntu21:68.2.1+build1-0ubuntu11:68.2.2+build1-0ubuntu11:68.3.0+build2-0ubuntu1 Show 15 moreShow less1:68.3.1+build1-0ubuntu21:68.4.1+build1-0ubuntu11:68.4.2+build2-0ubuntu11:68.5.0+build1-0ubuntu11:68.6.0+build2-0ubuntu11:68.7.0+build1-0ubuntu11:68.7.0+build1-0ubuntu21:68.8.0+build2-0ubuntu0.20.04.21:68.10.0+build1-0ubuntu0.20.04.11:78.7.1+build1-0ubuntu0.20.04.11:78.8.1+build1-0ubuntu0.20.04.11:78.11.0+build1-0ubuntu0.20.04.21:78.13.0+build1-0ubuntu0.20.04.21:78.14.0+build1-0ubuntu0.20.04.11:78.14.0+build1-0ubuntu0.20.04.2 | 1:91.5.0+build1-0ubuntu0.20.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43529 is a critical vulnerability (CVSS 9.8) in Mozilla Thunderbird, published November 4, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in thunderbird 1:91.3.0-1.
References
bugzilla.mozilla.org/show_bug.cgi?id=CVE-2021-43529
nvd.nist.gov/vuln/detail/CVE-2021-43529
github.com/advisories/GHSA-82q7-2fg2-4gcj
security-tracker.debian.org/tracker/CVE-2021-43529
access.redhat.com/errata/RHSA-2021:4130
Show 48 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2019621
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4130.json
cve.org/CVERecord?id=CVE-2021-38503
errata.rockylinux.org/RLSA-2021:4130
ubuntu.com/security/CVE-2021-43529
openwall.com/lists/oss-security/2021/12/01/6
Left out here: 285 versions. The JSON record has them.