Vulnerability-Lookup

CVE-2026-84641 (GCVE-0-2026-84641)

Vulnerability from cvelistv5 – Published: 2026-09-01 21:33 – Updated: 2026-09-02 18:47

Title

Information disclosure due to malicious IMAP server response

Summary

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 18:44 UTC

CWE

CWE-416 - Use After Free

Assigner

mozilla mitre root

References

4 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=2057805
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…
https://www.mozilla.org/security/advisories/mfsa2…

Impacted products

1 product

Vendor	Product	Version	CPE status
Mozilla	Thunderbird	Unaffected: 140.15 , ≤ 140.* (rpm) Unaffected: 153.2 , ≤ 153.* (rpm) Unaffected: 155 , ≤ * (rpm)	guessed

Credits

ABDULAZIZ ALASAIQAH

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-84641",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T18:44:59.344215Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T18:47:17.033Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.15",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.2",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "155",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ABDULAZIZ ALASAIQAH"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2."
            }
          ],
          "value": "A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-01T21:44:15.877Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057805"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-86/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/"
        },
        {
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-88/"
        }
      ],
      "title": "Information disclosure due to malicious IMAP server response"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2026-84641",
    "datePublished": "2026-09-01T21:33:07.410Z",
    "dateReserved": "2026-09-01T21:33:07.129Z",
    "dateUpdated": "2026-09-02T18:47:17.033Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84641",
      "date": "2026-09-17",
      "epss": "0.00267",
      "percentile": "0.19028"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-84641\",\"sourceIdentifier\":\"security@mozilla.org\",\"published\":\"2026-09-01T22:17:19.900\",\"lastModified\":\"2026-09-03T19:01:11.823\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.\"}],\"affected\":[{\"source\":\"security@mozilla.org\",\"affectedData\":[{\"vendor\":\"Mozilla\",\"product\":\"Thunderbird\",\"versions\":[{\"version\":\"140.15\",\"lessThanOrEqual\":\"140.*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"153.2\",\"lessThanOrEqual\":\"153.*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"155\",\"lessThanOrEqual\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-02T18:44:59.344215Z\",\"id\":\"CVE-2026-84641\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"140.15.0\",\"matchCriteriaId\":\"EC44CB46-89FD-40DC-92D1-F865A0521D06\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"141.0\",\"versionEndExcluding\":\"153.2.0\",\"matchCriteriaId\":\"B217A29A-45B5-407C-9B4B-96CF6EB0838E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"154.0\",\"versionEndExcluding\":\"155.0\",\"matchCriteriaId\":\"C6AB910B-074A-42F7-A3C7-B7E822011D92\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.mozilla.org/show_bug.cgi?id=2057805\",\"source\":\"security@mozilla.org\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-86/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-87/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.mozilla.org/security/advisories/mfsa2026-88/\",\"source\":\"security@mozilla.org\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-09-08T23:08:03+00:00",
      "cve": "CVE-2026-84641",
      "id": "CVE-2026-84641",
      "initial_release_date": "2026-09-01T21:33:07.410000+00:00",
      "product_status:known_affected": "11",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "thunderbird: Information disclosure due to malicious IMAP server response",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84641.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:05:14Z",
      "cve": "CVE-2026-84641",
      "id": "CVE-2026-84641",
      "initial_release_date": "2026-09-02T11:29:08Z",
      "product_status:first_fixed": "15",
      "product_status:known_affected": "95",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-84641",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-84641.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-84641\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-02T18:44:59.344215Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-02T18:45:37.542Z\"}}], \"cna\": {\"title\": \"Information disclosure due to malicious IMAP server response\", \"credits\": [{\"lang\": \"en\", \"value\": \"ABDULAZIZ ALASAIQAH\"}], \"affected\": [{\"vendor\": \"Mozilla\", \"product\": \"Thunderbird\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"140.15\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"140.*\"}, {\"status\": \"unaffected\", \"version\": \"153.2\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"153.*\"}, {\"status\": \"unaffected\", \"version\": \"155\", \"versionType\": \"rpm\", \"lessThanOrEqual\": \"*\"}]}], \"references\": [{\"url\": \"https://bugzilla.mozilla.org/show_bug.cgi?id=2057805\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-86/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-87/\"}, {\"url\": \"https://www.mozilla.org/security/advisories/mfsa2026-88/\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"shortName\": \"mozilla\", \"dateUpdated\": \"2026-09-01T21:44:15.877Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-84641\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-02T18:47:17.033Z\", \"dateReserved\": \"2026-09-01T21:33:07.129Z\", \"assignerOrgId\": \"f16b083a-5664-49f3-a51e-8d479e5ed7fe\", \"datePublished\": \"2026-09-01T21:33:07.410Z\", \"assignerShortName\": \"mozilla\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1106

Vulnerability from certfr_avis - Published: 2026-09-02 - Updated: 2026-09-02

De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 115.40
Mozilla	Firefox	Firefox versions antérieures à 155
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 153.2
Mozilla	Firefox ESR	Firefox ESR versions antérieures à 140.15
Mozilla	Thunderbird ESR	Thunderbird ESR versions antérieures à 153.2
Mozilla	Thunderbird ESR	Thunderbird ESR versions antérieures à 140.15
Mozilla	Thunderbird	Thunderbird versions antérieures à 155

References

Title

Publication Time

FKIE_CVE-2026-84641

Vulnerability from fkie_nvd - Published: 2026-09-01 22:17 - Updated: 2026-09-03 19:01

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security@mozilla.org	https://bugzilla.mozilla.org/show_bug.cgi?id=2057805	Permissions Required
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2026-86/	Vendor Advisory
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2026-87/	Vendor Advisory
security@mozilla.org	https://www.mozilla.org/security/advisories/mfsa2026-88/	Vendor Advisory

Impacted products

Vendor	Product	Version
mozilla	thunderbird	*
mozilla	thunderbird	*
mozilla	thunderbird	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThanOrEqual": "140.*",
              "status": "unaffected",
              "version": "140.15",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "153.*",
              "status": "unaffected",
              "version": "153.2",
              "versionType": "rpm"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "155",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "security@mozilla.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC44CB46-89FD-40DC-92D1-F865A0521D06",
              "versionEndExcluding": "140.15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B217A29A-45B5-407C-9B4B-96CF6EB0838E",
              "versionEndExcluding": "153.2.0",
              "versionStartIncluding": "141.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6AB910B-074A-42F7-A3C7-B7E822011D92",
              "versionEndExcluding": "155.0",
              "versionStartIncluding": "154.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2."
    }
  ],
  "id": "CVE-2026-84641",
  "lastModified": "2026-09-03T19:01:11.823",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84641",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T18:44:59.344215Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-01T22:17:19.900",
  "references": [
    {
      "source": "security@mozilla.org",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057805"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-86/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-87/"
    },
    {
      "source": "security@mozilla.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-88/"
    }
  ],
  "sourceIdentifier": "security@mozilla.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-F2HG-25F8-VGFJ

Vulnerability from github – Published: 2026-09-02 00:31 – Updated: 2026-09-02 21:32

Details

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-84641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-01T22:17:19Z",
    "severity": "HIGH"
  },
  "details": "A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
  "id": "GHSA-f2hg-25f8-vgfj",
  "modified": "2026-09-02T21:32:02Z",
  "published": "2026-09-02T00:31:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84641"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2057805"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-86"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-87"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2026-88"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

oesa-2026-3842

Vulnerability from osv_openeuler

Published

2026-09-14 16:34

Modified

2026-09-14 16:34

Summary

thunderbird security update

Details

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)

Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)

Privilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84639)

A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84640)

Severity

9.8 (Critical)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84119	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84120	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84121	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84122	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84124	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84131	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84143	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84145	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84639	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84640	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-84641	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "thunderbird-140.15.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-debuginfo-140.15.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-debugsource-140.15.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-librnp-rnp-140.15.0-1.oe2403sp4.aarch64.rpm",
          "thunderbird-wayland-140.15.0-1.oe2403sp4.aarch64.rpm"
        ],
        "src": [
          "thunderbird-140.15.0-1.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "thunderbird-140.15.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-debuginfo-140.15.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-debugsource-140.15.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-librnp-rnp-140.15.0-1.oe2403sp4.x86_64.rpm",
          "thunderbird-wayland-140.15.0-1.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "thunderbird",
        "purl": "pkg:rpm/openEuler/thunderbird\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "140.15.0-1.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Critical"
  },
  "details": "Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84119)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84120)\n\nSandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84121)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84122)\n\nUse-after-free in the DOM: Core \u0026amp; HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84124)\n\nPrivilege escalation due to invalid pointer in the Graphics component of Mozilla Firefox. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84131)\n\nInternally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84143)\n\nInternally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.(CVE-2026-84145)\n\nTriggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84639)\n\nA maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84640)\n\nA malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.(CVE-2026-84641)",
  "id": "OESA-2026-3842",
  "modified": "2026-09-14T16:34:54Z",
  "published": "2026-09-14T16:34:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3842"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84119"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84120"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84121"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84122"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84124"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84131"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84143"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84145"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84639"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84640"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84641"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "thunderbird security update",
  "upstream": [
    "CVE-2026-84119",
    "CVE-2026-84120",
    "CVE-2026-84121",
    "CVE-2026-84122",
    "CVE-2026-84124",
    "CVE-2026-84131",
    "CVE-2026-84143",
    "CVE-2026-84145",
    "CVE-2026-84639",
    "CVE-2026-84640",
    "CVE-2026-84641"
  ]
}

OPENSUSE-SU-2026:11678-1

Vulnerability from csaf_opensuse - Published: 2026-09-04 00:00 - Updated: 2026-09-16 21:29

Summary

MozillaThunderbird-140.15.0-1.1 on GA media

Severity

Moderate

Scope

13 vulnerabilities in this advisory, including CVE-2026-84641.

CVE-2026-84641

8.3 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Recommended: 16 products

Open the full advisory

ubuntu-cve-2026-84641

Vulnerability from osv_ubuntu

Published

2026-09-01 22:17

Modified

2026-09-16 11:43

Summary

Details

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-84641	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-84641	REPORT
	https://www.mozilla.org/en-US/security/advisories…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "thunderbird",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "thunderbird-gnome-support",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "thunderbird-mozsymbols",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-calendar-timezones",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-gdata-provider",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          },
          {
            "binary_name": "xul-ext-lightning",
            "binary_version": "1:140.7.1+build1-0ubuntu0.22.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "thunderbird",
        "purl": "pkg:deb/ubuntu/thunderbird@1:140.7.1+build1-0ubuntu0.22.04.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:91.1.2+build1-0ubuntu1",
        "1:91.3.0+build2-0ubuntu1",
        "1:91.3.1+build1-0ubuntu1",
        "1:91.3.2+build1-0ubuntu1",
        "1:91.4.0+build1.1-0ubuntu1",
        "1:91.4.0+build2-0ubuntu1",
        "1:91.5.0+build1-0ubuntu1",
        "1:91.5.1+build1-0ubuntu1",
        "1:91.6.1+build1-0ubuntu1",
        "1:91.7.0+build1-0ubuntu1",
        "1:91.7.0+build2-0ubuntu1",
        "1:91.8.0+build2-0ubuntu1",
        "1:91.9.1+build1-0ubuntu0.22.04.1",
        "1:91.11.0+build2-0ubuntu0.22.04.1",
        "1:102.2.2+build1-0ubuntu0.22.04.1",
        "1:102.4.2+build2-0ubuntu0.22.04.1",
        "1:102.7.1+build2-0ubuntu0.22.04.1",
        "1:102.8.0+build2-0ubuntu0.22.04.1",
        "1:102.9.0+build1-0ubuntu0.22.04.1",
        "1:102.10.0+build2-0ubuntu0.22.04.1",
        "1:102.11.0+build1-0ubuntu0.22.04.1",
        "1:102.13.0+build1-0ubuntu0.22.04.1",
        "1:102.15.0+build1-0ubuntu0.22.04.1",
        "1:102.15.1+build1-0ubuntu0.22.04.1",
        "1:115.3.1+build1-0ubuntu0.22.04.2",
        "1:115.4.1+build1-0ubuntu0.22.04.1",
        "1:115.5.0+build1-0ubuntu0.22.04.1",
        "1:115.6.0+build2-0ubuntu0.22.04.1",
        "1:115.8.1+build1-0ubuntu0.22.04.1",
        "1:115.9.0+build1-0ubuntu0.22.04.1",
        "1:115.10.1+build1-0ubuntu0.22.04.1",
        "1:115.11.0+build2-0ubuntu0.22.04.1",
        "1:115.12.0+build3-0ubuntu0.22.04.1",
        "1:115.13.0+build5-0ubuntu0.22.04.1",
        "1:115.15.0+build1-0ubuntu0.22.04.1",
        "1:115.16.0+build2-0ubuntu0.22.04.1",
        "1:115.18.0+build1-0ubuntu0.22.04.1",
        "1:128.12.0+build1-0ubuntu0.22.04.1",
        "1:140.7.1+build1-0ubuntu0.22.04.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "thunderbird",
            "binary_version": "2:1snap1-0ubuntu3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "thunderbird",
        "purl": "pkg:deb/ubuntu/thunderbird@2:1snap1-0ubuntu3?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1:115.3.1+build1-0ubuntu1",
        "1:115.4.1+build1-0ubuntu1",
        "1:115.4.3+build1-0ubuntu1",
        "1:115.5.0+build1-0ubuntu1",
        "1:115.5.1+build1-0ubuntu1",
        "1:115.5.2+build2-0ubuntu1",
        "1:115.6.0+build1-0ubuntu1",
        "1:115.6.0+build2-0ubuntu1",
        "1:115.6.1+build1-0ubuntu1",
        "1:115.8.0+build1-0ubuntu1",
        "1:115.8.1+build1+snap2",
        "1:115.8.1+build1+snap3",
        "2:1snap1-0ubuntu1",
        "2:1snap1-0ubuntu3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "thunderbird",
            "binary_version": "2:1snap1-0ubuntu5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "thunderbird",
        "purl": "pkg:deb/ubuntu/thunderbird@2:1snap1-0ubuntu5?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2:1snap1-0ubuntu3",
        "2:1snap1-0ubuntu4",
        "2:1snap1-0ubuntu5"
      ]
    }
  ],
  "aliases": [],
  "details": "A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.",
  "id": "UBUNTU-CVE-2026-84641",
  "modified": "2026-09-16T11:43:10Z",
  "published": "2026-09-01T22:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-84641"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84641"
    },
    {
      "type": "REPORT",
      "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/#CVE-2026-84641"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-84641"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-84641 (GCVE-0-2026-84641)

CERTFR-2026-AVI-1106

Solutions

FKIE_CVE-2026-84641

GHSA-F2HG-25F8-VGFJ

oesa-2026-3842

Vulnerability from osv_openeuler

OPENSUSE-SU-2026:11678-1

ubuntu-cve-2026-84641

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature

Related by attack behaviour