CVE-2026-84637

CVE-2026-84637 is a flaw in Mozilla Thunderbird's handling of calendar invitations: an attachment in a malicious invitation using a file:// URI can cause Windows to launch a local or network-hosted executable, bypassing Thunderbird's normal protections on executable attachments. It is triggered when a crafted calendar invitation is processed; when the new invitation display is enabled, the attachment can additionally be shown under a misleading filename. An attacker gains the ability to run executables of their choosing on the victim's Windows machine, which can lead to malware execution; Mozilla rates the flaw 9.8 (critical). Affected users are those running Thunderbird on Windows in versions before 154, or the 153.x branch before 153.2. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS currently estimates only a 0.3% chance of exploitation within 30 days.

What to do: Upgrade Windows installations of Thunderbird to version 154 or 153.2 (or later) as soon as possible. Until patched, treat calendar invitations from untrusted senders with caution, avoid opening or accepting file:// URI attachments in invitations, and consider not enabling the new invitation display, since it can present attachments under misleading filenames.