CVE-2026-84641
published 2026-09-01CVE-2026-84641: A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.27%
17.6th percentile
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 153.2 | Thunderbird 153.2 |
| mozilla | thunderbird | < Thunderbird 140.15 | Thunderbird 140.15 |
| mozilla | thunderbird | < Thunderbird 155 | Thunderbird 155 |
| mozilla | thunderbird | < 140.15.0 | 140.15.0 |
| mozilla | thunderbird | — | — |
| mozilla | thunderbird | >= 141.0 < 153.2.0 | 153.2.0 |
| mozilla | thunderbird | >= 154.0 < 155.0 | 155.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat8.3HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: Thunderbird: Information disclosure via malicious IMAP server response
vendor_redhat·2026-09-01·CVSS 8.3
CVE-2026-84641 [HIGH] CWE-825 thunderbird: Thunderbird: Information disclosure via malicious IMAP server response
thunderbird: Thunderbird: Information disclosure via malicious IMAP server response
A flaw was found in Thunderbird. A remote attacker, by operating a malicious Internet Message Access Protocol (IMAP) server, could send a specially crafted ID response. This could trigger a use-after-free vulnerability and lead to heap-memory disclosure, allowing sensitive heap contents to be persisted to the prefs.js file.
Package: thunderbird (Red Hat Enterprise Linux 10) - Affected
Package: thunderbird (Red Hat Enterprise Linux 8) - Affected
Package: thunderbird (Red Hat Enterprise Linux 9) - Affected
Mozilla
Mozilla Foundation Security Advisory 2026-88: CVE-2026-84641
vendor_mozilla
CVE-2026-84641 Mozilla Foundation Security Advisory 2026-88: CVE-2026-84641
Mozilla Foundation Security Advisory 2026-88
CVE: CVE-2026-84641
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 153.2
Mozilla
Mozilla Foundation Security Advisory 2026-87: CVE-2026-84641
vendor_mozilla
CVE-2026-84641 Mozilla Foundation Security Advisory 2026-87: CVE-2026-84641
Mozilla Foundation Security Advisory 2026-87
CVE: CVE-2026-84641
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 140.15
Mozilla
Mozilla Foundation Security Advisory 2026-86: CVE-2026-84641
vendor_mozilla
CVE-2026-84641 Mozilla Foundation Security Advisory 2026-86: CVE-2026-84641
Mozilla Foundation Security Advisory 2026-86
CVE: CVE-2026-84641
Product: Thunderbird
Impact: high
Fixed in: Thunderbird 155
GHSA
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response.
ghsa_unreviewed·2026-09-02
CVE-2026-84641 A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response.
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
VulDB
Mozilla Thunderbird up to 140.14/153.1/154 IMAP ID prefs.js use after free (EUVD-2026-69710)
vuldb·2026-09-01
CVE-2026-84641 [CRITICAL] Mozilla Thunderbird up to 140.14/153.1/154 IMAP ID prefs.js use after free (EUVD-2026-69710)
A vulnerability classified as critical was found in Mozilla Thunderbird up to 140.14/153.1/154. Affected by this vulnerability is an unknown functionality of the file prefs.js of the component IMAP ID Handler. Executing a manipulation can lead to use after free.
This vulnerability is handled as CVE-2026-84641. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-09-01
Published