CVE-2026-84637: Vulnerability in Mozilla Thunderbird

The vulnerability CVE-2026-84637 in Mozilla Thunderbird involves malicious calendar invitations that exploit file URI attachments to execute local or network-hosted executables on Windows systems. This bypasses the usual protections Thunderbird has against executable attachments. Additionally, with the new invitation display enabled, the attachment could be shown with a misleading filename, increasing the risk of user deception. The issue was addressed and fixed in Thunderbird versions 154 and 153.2. The Mozilla advisory clarifies that exploitation via email is generally not possible due to scripting restrictions in Thunderbird's mail reading interface, but risks remain in browser-like contexts.

If exploited, this vulnerability could allow an attacker to execute arbitrary code on a Windows machine via malicious calendar invitations, potentially leading to full system compromise. However, the vendor notes the impact is low in typical email usage scenarios because scripting is disabled when reading mail, limiting exploitation vectors. The vulnerability is more relevant in browser or browser-like contexts where such protections may not apply.

This vulnerability has been fixed in Thunderbird versions 154 and 153.2. Users and administrators should update to these versions or later to mitigate this issue. Since the vendor advisory states that these flaws generally cannot be exploited through email in Thunderbird due to scripting being disabled, no additional immediate mitigation steps are required beyond applying the official update.