CVE-2026-84641

Thunderbird contains a use-after-free (CWE-416) in its handling of the IMAP ID extension: a malicious or compromised IMAP server can send a specially crafted ID response that triggers the flaw and causes heap memory to be disclosed. An attacker gains read access to process heap contents, which can ultimately be persisted into the user's prefs.js file, exposing potentially sensitive data; the vulnerability has no integrity or availability impact. Users are affected when they connect to an IMAP server that is attacker-controlled, compromised, or spoofed, making mail users with IMAP accounts the primary exposure population. As of now there is no known public proof-of-concept, the CISA KEV catalog does not list it, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days, so no active exploitation is known.

What to do: Upgrade Thunderbird to 155, 140.15, or 153.2 depending on your release branch. As an interim mitigation, avoid connecting to untrusted or unencrypted IMAP servers, and inspect prefs.js (and leaked heap data) on systems that connected to potentially hostile servers to check for unexpectedly persisted sensitive strings.