CVE-2026-84640: Vulnerability in Mozilla Thunderbird

CVE-2026-84640 describes a one byte buffer over-read vulnerability in the mail parser of Mozilla Thunderbird caused by a maliciously constructed mail header. This flaw could lead to reading memory just past the intended buffer boundary. The vulnerability was reported by researchers from CoE-CNDS Lab, VJTI, Mumbai, India. Mozilla fixed this issue in Thunderbird versions 155, 140.15, and 153.2. According to Mozilla advisories, exploitation through email is unlikely due to disabled scripting in mail reading, but potential risks remain in browser or browser-like contexts. The vulnerability is part of a broader set of security fixes released in these Thunderbird versions.

The vulnerability allows a one byte read past the end of a buffer, which could lead to information disclosure or memory corruption under certain conditions. However, because Thunderbird disables scripting when reading mail, exploitation through email is generally not possible. The impact is rated medium by Mozilla, but the CVSS score is high (7.5) due to the network attack vector and potential confidentiality impact. There are no known exploits in the wild. The vulnerability is relevant primarily in contexts where mail parsing occurs in browser-like environments.

This vulnerability has been fixed in Thunderbird versions 155, 140.15, and 153.2. Users and administrators should upgrade to one of these fixed versions to remediate the issue. No additional mitigation actions are required as the vendor advisories confirm the flaw is patched. Since this is not a cloud service, local patching is necessary. There are no indications that the vulnerability is exploitable through normal email usage due to disabled scripting in mail reading.