CVE-2026-84639
published 2026-09-01CVE-2026-84639: Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird…
PriorityP344critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.32%
23.7th percentile
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 155 | Thunderbird 155 |
| mozilla | thunderbird | < Thunderbird 153.2 | Thunderbird 153.2 |
| mozilla | thunderbird | < Thunderbird 140.15 | Thunderbird 140.15 |
| mozilla | thunderbird | < 140.15.0 | 140.15.0 |
| mozilla | thunderbird | — | — |
| mozilla | thunderbird | >= 141.0 < 153.2.0 | 153.2.0 |
| mozilla | thunderbird | >= 154.0 < 155.0 | 155.0 |
| rhel10 | thunderbird-flatpak | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_redhat9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: Uninitialized memory in MIME parsing
vendor_redhat·2026-09-01·CVSS 9.1
CVE-2026-84639 [CRITICAL] CWE-824 thunderbird: Uninitialized memory in MIME parsing
thunderbird: Uninitialized memory in MIME parsing
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Triggering an error condition in certain MIME bodies would cause uninitialized
memory to be used.
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.
Package: rhel10/thunderbird-flatpak (Red Hat Enterprise Linux 10) - Affected
Package: thunderbird (Red Hat Enterprise Linux 10) - Affected
Package: thunderbird (Red Hat Enterprise Linux 6) - Out of support scope
Package:
Mozilla
Mozilla Foundation Security Advisory 2026-86: CVE-2026-84639
vendor_mozilla
CVE-2026-84639 Mozilla Foundation Security Advisory 2026-86: CVE-2026-84639
Mozilla Foundation Security Advisory 2026-86
CVE: CVE-2026-84639
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 155
Mozilla
Mozilla Foundation Security Advisory 2026-88: CVE-2026-84639
vendor_mozilla
CVE-2026-84639 Mozilla Foundation Security Advisory 2026-88: CVE-2026-84639
Mozilla Foundation Security Advisory 2026-88
CVE: CVE-2026-84639
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153.2
Mozilla
Mozilla Foundation Security Advisory 2026-87: CVE-2026-84639
vendor_mozilla
CVE-2026-84639 Mozilla Foundation Security Advisory 2026-87: CVE-2026-84639
Mozilla Foundation Security Advisory 2026-87
CVE: CVE-2026-84639
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140.15
GHSA
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.
ghsa_unreviewed·2026-09-02
CVE-2026-84639 Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
VulDB
Mozilla Thunderbird up to 140.14/153.1/154 uninitialized pointer (EUVD-2026-69708)
vuldb·2026-09-01
CVE-2026-84639 [CRITICAL] Mozilla Thunderbird up to 140.14/153.1/154 uninitialized pointer (EUVD-2026-69708)
A vulnerability, which was classified as critical, was found in Mozilla Thunderbird up to 140.14/153.1/154. This affects an unknown part. The manipulation results in uninitialized pointer.
This vulnerability was named CVE-2026-84639. The attack may be performed from remote. There is no available exploit.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
2026-09-01
Published