CVE-2026-84641

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@mozilla.org

Published

2026-09-01

Last modified

2026-09-02

Weaknesses

CWE-416

Affected products

• Thunderbird (Mozilla)

References

• https://bugzilla.mozilla.org/show_bug.cgi?id=2057805
• https://www.mozilla.org/security/advisories/mfsa2026-86/
• https://www.mozilla.org/security/advisories/mfsa2026-87/
• https://www.mozilla.org/security/advisories/mfsa2026-88/