CVE-2026-84642

Received Received - Intake

Thunderbird Remote Attachment Hostname Bypass

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Mozilla Corporation

Description

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-01

Generated

2026-09-02

AI Q&A

2026-09-02

EPSS Evaluated

N/A

NVD

CVE-2026-84642

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	to 155 (inc)
mozilla	thunderbird	to 153.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves the mail.allowed_attachment_hostnames advanced config setting in Thunderbird. The values were used in a regular expression without proper escaping, allowing unintended hostnames to match and serve remote attachments.

Detection Guidance

This vulnerability is specific to Thunderbird's mail.allowed_attachment_hostnames configuration and requires checking the Thunderbird version. Run 'thunderbird --version' to verify if your version is below 155 or 153.2. If so, update immediately. No direct network detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to trick users into opening malicious attachments from unintended hostnames. This could lead to unauthorized access, data breaches, or malware infections on affected systems.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR (data protection) and HIPAA (health information privacy) by allowing access to sensitive attachments.

Mitigation Strategies

Update Thunderbird to version 155 or 153.2 or later to address the vulnerability in the mail.allowed_attachment_hostnames setting.

Hi! I’m here to help you understand CVE-2026-84642. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70