CVEvulnerability
CVE-2026-84639
9.1 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-01
- Last modified
- 2026-09-03
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
- Weaknesses
- CWE-457
Description
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Affected configurations
• mozilla thunderbird (< 140.15.0)
• mozilla thunderbird (>= 141.0 < 153.2.0)
• mozilla thunderbird (>= 154.0 < 155.0)
Related
Weakness · CWE (1)
- CWE-457 Use of Uninitialized Variable weakness
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2061087 Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2026-86/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-87/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2026-88/ Vendor Advisory