CVE-2026-84637

Published: Sep 1, 2026Modified: Sep 3, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

Affected (2)

Products: Mozilla: Thunderbird

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mozilla Thunderbird	Before 153.2.0
Mozilla Thunderbird	From 154.0 to 155.0

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (3)

https://bugzilla.mozilla.org/show_bug.cgi?id=2043878

Source: security@mozilla.org

Permissions Required

https://www.mozilla.org/security/advisories/mfsa2026-78/

Source: security@mozilla.org

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2026-88/

Source: security@mozilla.org

Vendor Advisory

Timeline

No history available yet.