CVE-2026-84637

CriticalCVSS 9.8/10Last modified Sep 3, 2026

Description

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2043878Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-78/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-88/Vendor Advisory

Timeline

Published: Sep 1, 2026
Last modified: Sep 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-846399.1Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbir CVE-2026-84648.3Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an attacker in the same local network to re CVE-2026-846407.5A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 15 CVE-2026-846417.5A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately CVE-2026-846427.5The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some pos CVE-2026-846458.8In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi CVE-2026-846464.3In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all CVE-2026-846478.8In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,CVE-2026-846488.8In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta CVE-2026-846498.8In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th CVE-2026-846508.8In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to CVE-2026-846516.3In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm