Executive brief
Thunderbird is an email and messaging client used by millions of people. A malicious email with a specially crafted MIME body can trigger an error that causes the application to read uninitialized memory, potentially exposing sensitive information or causing unexpected behavior. The vulnerability affects multiple Thunderbird releases but has been fixed in recent versions.
Technical details
This is an uninitialized memory use vulnerability (a type of information disclosure / memory safety issue) in the MIME parser component. Triggering a specific error condition in malformed MIME bodies causes uninitialized heap or stack memory to be accessed and potentially processed. The attack vector is network-based: a remote attacker sends a specially crafted email to a victim. No authentication or user interaction beyond opening/processing the email is required. An attacker could exploit this to read sensitive data from process memory. Thunderbird 155, ESR 140.15, and ESR 153.2 and later versions contain the fix; earlier versions remain vulnerable.
Affected products
- Mozilla Thunderbird before 155; ESR before 140.15; ESR before 153.2
Timeline
- 2026-09-01: disclosed: CVE-2026-84639 advisory published
- 2026-09-01: patched: Fixed in Thunderbird 155, ESR 140.15, and ESR 153.2