CVE-2026-84641

Received Received - Intake

Heap Memory Disclosure in Thunderbird via IMAP ID Response

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Mozilla Corporation

Description

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84641

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	155
mozilla	thunderbird	140.15
mozilla	thunderbird	153.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

A malicious IMAP server can exploit this vulnerability by sending a specially crafted ID response to Thunderbird. This triggers a use-after-free error and allows disclosure of heap memory. The vulnerability can lead to sensitive data being written to prefs.js, a file that stores user preferences in Thunderbird.

Detection Guidance

Detection requires checking Thunderbird version against patched releases. Compare installed version with Thunderbird 155, 140.15, or 153.2. No direct commands detect exploitation, but monitoring for crashes or unusual prefs.js writes may indicate issues.

Impact Analysis

If you use Thunderbird and connect to a malicious IMAP server, this vulnerability could allow an attacker to read sensitive data from memory or write it to prefs.js. This might expose personal information, credentials, or other confidential data stored in Thunderbird.

Compliance Impact

This vulnerability could lead to unauthorized access or disclosure of personal data, which may violate GDPR and HIPAA requirements for data protection and confidentiality. Organizations using Thunderbird must ensure they apply the provided fixes to maintain compliance.

Mitigation Strategies

Update Thunderbird to version 155, 140.15, or 153.2 immediately. Avoid connecting to untrusted IMAP servers until patched. Review prefs.js for suspicious entries added after crashes.

Hi! I’m here to help you understand CVE-2026-84641. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70