CVE-2026-84641: Vulnerability in Mozilla Thunderbird

This vulnerability (CVE-2026-84641) in Mozilla Thunderbird involves a use-after-free condition triggered by a malicious IMAP server sending a specially crafted ID response. The flaw allows disclosure of heap memory contents, which can be persisted to the prefs.js configuration file. The issue was reported by Abdulaziz Alasaqah and is tracked under Bug 2057805. Mozilla fixed this vulnerability in Thunderbird releases 155, 140.15, and 153.2. The advisory notes that exploitation via email is unlikely due to disabled scripting in mail reading contexts, but potential risks remain in browser-like environments. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation can lead to disclosure of heap memory contents, potentially exposing sensitive information persisted to prefs.js. The vulnerability does not impact integrity or availability. Due to scripting being disabled when reading mail, exploitation through normal email use is unlikely, but risks exist in browser or browser-like contexts where the vulnerability could be triggered.

This vulnerability has been fixed in Thunderbird versions 155, 140.15, and 153.2. Users and administrators should upgrade to one of these fixed versions to remediate the issue. No additional mitigation steps are required as the vendor advisory does not indicate any temporary workarounds or partial mitigations.