# CVE-2026-84637: Mozilla Thunderbird calendar invitation code execution on Windows

Source: https://junglewise.ai/threats/cve-2026-84637-mozilla-thunderbird-calendar-invitation-code-execution-on-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84637 · Severity: critical · CVSS 9.8 · Published 2026-09-01

Thunderbird is an email and calendar client used for personal and business communication. An attacker can send a malicious calendar invitation with a file URI attachment that bypasses Thunderbird's protections and launches executables on a Windows computer, potentially leading to malware installation or system compromise. The vulnerability can also display the attachment under a misleading filename to trick users into opening it.

Technologies: [Mozilla Thunderbird](https://junglewise.ai/threats/technologies/thunderbird). Vendors: [Mozilla](https://junglewise.ai/threats/vendors/mozilla).

## Quick answers

**Is CVE-2026-84637 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84637 being exploited in the wild.

**How severe is CVE-2026-84637?** Critical severity, with a CVSS score of 9.8, published 1 September 2026.

**Which products and versions are affected?** Mozilla Thunderbird before 153.2 and before 154.

**Is there a fix for CVE-2026-84637?** A patch was published on 2026: Fixed in Thunderbird 154 and 153.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84637 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-84637?** Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an attachment handling bypass in Thunderbird's calendar invitation processing. The root cause is insufficient validation of file URI attachments in calendar invitations on Windows, allowing attackers to bypass the normal executable attachment protections. The attack requires a user to receive and interact with a malicious calendar invitation; no authentication or network access beyond email delivery is required. An attacker can execute arbitrary local or network-hosted executables with the privileges of the Thunderbird process. The vulnerability was fixed in Thunderbird 154 and 153.2.

## Affected products

- Mozilla Thunderbird before 153.2 and before 154

## Timeline

- 2026-08-18: disclosed: Announced in Mozilla Security Advisory MFSA2026-78
- 2026: patched: Fixed in Thunderbird 154 and 153.2

## References

- [https://bugzilla.mozilla.org/show_bug.cgi?id=2043878](https://bugzilla.mozilla.org/show_bug.cgi?id=2043878)
- [https://www.mozilla.org/security/advisories/mfsa2026-78/](https://www.mozilla.org/security/advisories/mfsa2026-78/)

## Related threats

- [Thunderbird OAuth2 access token leak over HTTP with Exchange accounts](https://junglewise.ai/threats/cve-2026-126136-for-exchange-accounts-using-ews-or-microsoft-graph-with-oauth2)
- [Mozilla Thunderbird SMTP/POP3 response injection via STARTTLS](https://junglewise.ai/threats/cve-2026-126135-if-an-attacker-was-able-to-perform-a-man-in-the-middle-attack-on)
- [Thunderbird NTLM credential leak via feed subscription to file URL](https://junglewise.ai/threats/cve-2026-126134-thunderbird-allowed-feed-subscriptions-to-file-urls-that-point)
- [Thunderbird calendar server credentials sent to HTTP proxy](https://junglewise.ai/threats/cve-2026-126133-when-a-caldav-or-ics-calendar-was-accessed-through-an-http-proxy)
- [Thunderbird attachment replacement disclosure via link files](https://junglewise.ai/threats/cve-2026-126132-when-a-message-was-forwarded-inline-edited-as-new-or-had-an)