CVE-2026-84145

Mozilla fixed a set of internally discovered bugs in Thunderbird 154, Thunderbird ESR 153.1, and Thunderbird ESR 140.14, several of which showed evidence of memory corruption (CWE-119) that Mozilla presumes could be exploited with sufficient attacker effort. Because Thunderbird and Firefox share the affected code, fixes were shipped for both products; the bugs would be triggered by untrusted content such as a malicious web page, email message, or attachment opened in the application, with user interaction required. Successful exploitation could yield a high-impact compromise of confidentiality, integrity, and availability (CVSS 3.1: 7.5 high, with network vector, high attack complexity, and no privileges required). Anyone running the affected builds — Thunderbird 154, ESR 153.1, or ESR 140.14, and Firefox releases preceding the fixed builds 155 and ESR 115.40/140.15/153.2 — is affected. There is no evidence of exploitation in the wild and no public proof-of-concept; EPSS estimates roughly a 0.4% chance of exploitation within 30 days.

What to do: Upgrade Firefox to 155, or on the ESR branches to 115.40, 140.15, or 153.2, and upgrade Thunderbird to 155, 153.2, or 140.15 as applicable to your branch. Inventory managed endpoints for Thunderbird 154/ESR 153.1/ESR 140.14 and the corresponding Firefox builds, prioritizing mail clients since email-borne content is a likely trigger. No public exploits or workarounds are known, so prompt patching before users open untrusted content is the primary mitigation.