CVE-2026-84642

7.5 highEPSS 0.4%

High (7.5) in mozilla thunderbird. EPSS 0.4% chance of exploitation in the next 30 days.

The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
CWE: CWE-1333
Published: 2026-09-01
Modified: 2026-09-03
Record from: the NVD, synced 2026-10-19

Affected

mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2060462
https://www.mozilla.org/security/advisories/mfsa2026-86/
https://www.mozilla.org/security/advisories/mfsa2026-88/

Check your stack JSON