CVE-2026-84639

9.1 criticalEPSS 0.3%

Critical (9.1) in mozilla thunderbird. EPSS 0.3% chance of exploitation in the next 30 days.

Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-457
Published: 2026-09-01
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Affected

mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2061087
https://www.mozilla.org/security/advisories/mfsa2026-86/
https://www.mozilla.org/security/advisories/mfsa2026-87/
https://www.mozilla.org/security/advisories/mfsa2026-88/

Check your stack JSON