CVE-2026-84641: Information disclosure due to malicious IMAP server response
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 140.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 155 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.2 - Upgrade
Upgrade
Mozilla Thunderbirdto a version that resolves this vulnerability.Fixed in 155
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-84639
- CVE-2026-84640
- CVE-2026-84641
- CVE-2026-75874
- CVE-2026-16365
- CVE-2026-84119
- CVE-2026-84120
- CVE-2026-84121
- CVE-2026-84122
- CVE-2026-84124
- CVE-2026-16371
- CVE-2026-84131
- CVE-2026-84143
- CVE-2026-84145
- CVE-2026-84642
- CVE-2026-84118
- CVE-2026-84123
- CVE-2026-84125
- CVE-2026-84126
- CVE-2026-84128
- CVE-2026-84129
- CVE-2026-84130
- CVE-2026-84132
- CVE-2026-84133
- CVE-2026-84134
- CVE-2026-84136
- CVE-2026-84137
- CVE-2026-84138
- CVE-2026-84139
- CVE-2026-84140
- CVE-2026-84141
- CVE-2026-84142
- CVE-2026-84144
- CVE-2026-84637
- CVE-2026-74952
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must control or operate a malicious IMAP server and send a crafted IMAP ID response to Thunderbird. The issue is triggered by processing that server response.
What data may be exposed, and where can it end up?
The vulnerability can disclose heap memory contents. Disclosed heap contents can ultimately be persisted in Thunderbird's prefs.js file.
Which Thunderbird release contains the fix?
The vulnerability was fixed in Thunderbird 155.