CVE-2026-84641

Analyzed Analyzed - Analysis Complete

Heap Memory Disclosure in Thunderbird via IMAP ID Response

Publication date: 2026-09-01

Last updated on: 2026-09-03

Assigner: Mozilla Corporation

Description

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-03

Generated

2026-09-22

AI Q&A

2026-09-02

EPSS Evaluated

2026-09-21

NVD

CVE-2026-84641

EUVD

EUVD-2026-69710

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	From 154.0 (inc) to 155.0 (exc)
mozilla	thunderbird	to 140.15.0 (exc)
mozilla	thunderbird	From 141.0 (inc) to 153.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

A malicious IMAP server can exploit this vulnerability by sending a specially crafted ID response to Thunderbird. This triggers a use-after-free error and allows disclosure of heap memory. The vulnerability can lead to sensitive data being written to prefs.js, a file that stores user preferences in Thunderbird.

Detection Guidance

Detection requires checking Thunderbird version against patched releases. Compare installed version with Thunderbird 155, 140.15, or 153.2. No direct commands detect exploitation, but monitoring for crashes or unusual prefs.js writes may indicate issues.

Impact Analysis

If you use Thunderbird and connect to a malicious IMAP server, this vulnerability could allow an attacker to read sensitive data from memory or write it to prefs.js. This might expose personal information, credentials, or other confidential data stored in Thunderbird.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, which may violate GDPR and HIPAA requirements for data protection and confidentiality. Organizations using Thunderbird must ensure they apply the provided fixes to maintain compliance.

Mitigation Strategies

Update Thunderbird to version 155, 140.15, or 153.2 immediately. Avoid connecting to untrusted IMAP servers until patched. Review prefs.js for suspicious entries added after crashes.

Hi! I’m here to help you understand CVE-2026-84641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70