CVE-2026-84639 - Uninitialized memory in MIME parsing

Q: Which Thunderbird release includes the fix?

The vulnerability was fixed in Thunderbird 155.

Q: What condition is required to trigger the issue?

An error condition must be triggered in certain MIME bodies.

Affected Software

4 affected componentsFixes available

Mozilla Thunderbird=155

Mozilla Thunderbird<155

155

Mozilla Thunderbird<140.15

140.15

Mozilla Thunderbird<153.2

153.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.15
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.2
Upgrade
Upgrade Mozilla Thunderbird to a version that resolves this vulnerability.
Fixed in 155

Event History

Sep 1, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

Updated

via Mozilla·12:00 AM

Affected Software

CVE Published

via MITRE·09:33 PM

Data Sourced

via MITRE·09:33 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

Which Thunderbird release includes the fix?

The vulnerability was fixed in Thunderbird 155.

2

What condition is required to trigger the issue?

An error condition must be triggered in certain MIME bodies.

CVE-2026-84639: Uninitialized memory in MIME parsing

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which Thunderbird release includes the fix?

What condition is required to trigger the issue?

Company

Resources

Contact