CVE-2026-84639: Uninitialized memory in MIME parsing
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.2 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 155 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 140.15 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.2
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-84639
- CVE-2026-84640
- CVE-2026-84641
- CVE-2026-84642
- CVE-2026-84118
- CVE-2026-84119
- CVE-2026-84120
- CVE-2026-84121
- CVE-2026-84122
- CVE-2026-84123
- CVE-2026-84124
- CVE-2026-84125
- CVE-2026-84126
- CVE-2026-84128
- CVE-2026-84129
- CVE-2026-84130
- CVE-2026-84131
- CVE-2026-84132
- CVE-2026-84133
- CVE-2026-84134
- CVE-2026-84136
- CVE-2026-84137
- CVE-2026-84138
- CVE-2026-84139
- CVE-2026-84140
- CVE-2026-84141
- CVE-2026-84142
- CVE-2026-84143
- CVE-2026-84144
- CVE-2026-84145
- CVE-2026-75874
- CVE-2026-16365
- CVE-2026-16371
- CVE-2026-84637
- CVE-2026-74952
Frequently Asked Questions
Which Thunderbird release includes the fix?
The vulnerability was fixed in Thunderbird 155.
What condition is required to trigger the issue?
An error condition must be triggered in certain MIME bodies.