CVE-2026-84642: Vulnerability in Mozilla Thunderbird

The vulnerability arises from the use of unescaped values in the mail.allowed_attachment_hostnames advanced config setting within a regular expression. This improper escaping can cause certain valid hostnames to unintentionally match, potentially allowing remote attachments to be served from unintended hosts. Mozilla fixed this issue in Thunderbird 155 and Thunderbird 153.2. The vendor advisory notes that exploitation through email is generally not possible due to disabled scripting in mail reading, but risks remain in browser or browser-like contexts.

The vulnerability could allow unintended hostnames to match in the regular expression used for allowed attachment hostnames, potentially enabling remote attachments to be served from these hosts. However, because Thunderbird disables scripting when reading mail, exploitation through email is unlikely. The impact is therefore limited primarily to browser or browser-like contexts where scripting might be enabled. The CVSS score is 7.5 (high), reflecting the potential confidentiality impact if exploited in such contexts.

This vulnerability has been fixed in Thunderbird versions 155 and 153.2. Users should update to at least Thunderbird 155 or Thunderbird 153.2 to remediate this issue. No additional mitigation actions are required as the vendor advisory states that these flaws cannot generally be exploited through email due to disabled scripting.