CVE-2026-84641
EUVD-2026-6971001.09.2026, 22:17
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| mozilla | thunderbird | 𝑥 < 140.15.0 |
| mozilla | thunderbird | 141.0 ≤ 𝑥 < 153.2.0 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| mozilla | thunderbird | 154.0 ≤ 𝑥 < 155.0 | CNA |
| mozilla | thunderbird_esr | 𝑥 < 140.15.0 | CNA |
| mozilla | thunderbird_esr | 141.0 ≤ 𝑥 < 153.2.0 | CNA |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| MozillaThunderbird |
| ||||||||
| MozillaThunderbird-translations-common |
| ||||||||
| MozillaThunderbird-translations-other |
|
Common Weakness Enumeration