Executive brief
Thunderbird, a popular email and calendar client used by millions, can be compromised by a malicious IMAP email server. By sending a specially crafted server response, an attacker can trigger memory corruption that leaks sensitive heap data, which may be written to local configuration files. This allows disclosure of potentially sensitive information stored in memory.
Technical details
The vulnerability is a use-after-free and heap-memory disclosure in Thunderbird's IMAP ID response handler. A malicious IMAP server can send a crafted ID response that causes the client to use memory that has already been freed, and to leak heap contents. The vulnerability is triggered by network interaction with a malicious IMAP server—no user interaction or authentication is required from the attacker's perspective, though the user must be connected to the attacker's IMAP server. An attacker can disclose heap memory contents that may be persisted to the prefs.js configuration file, potentially exposing sensitive data. The vulnerability was fixed in Thunderbird 155, 140.15, and 153.2.
Affected products
- Mozilla Thunderbird before 155, before 140.15, before 153.2
Timeline
- 2026-09-01: disclosed: CVE-2026-84641 announced in Mozilla Foundation Security Advisory 2026-86
- 2026-09-01: patched: Fixed in Thunderbird 155, Thunderbird 140.15 (ESR), and Thunderbird 153.2 (ESR)