Thunderbird IMAP use-after-free heap disclosure before 155
CVE-2026-84641 Published on September 1, 2026
Information disclosure due to malicious IMAP server response
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Products Associated with CVE-2026-84641
Want to know whenever a new CVE is published for Mozilla Thunderbird? stack.watch will email you.
Affected Versions
Mozilla Thunderbird:- Version 140.15, <= 140.* is unaffected.
- Version 153.2, <= 153.* is unaffected.
- Version 155, <= * is unaffected.