Critical severity9.1NVD Advisory· Published Sep 1, 2026· Updated Sep 3, 2026
CVE-2026-84639
CVE-2026-84639
Description
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Affected products
4- Range: before 155, before 140.15, and before 153.2
- Range: before 155, before 140.15, and before 153.2
- osv-coords2 versions
< 140.15.0-1.1+ 1 more
- (no CPE)range: < 140.15.0-1.1
- (no CPE)range: < 140.16.0-1.el9_8.alma.1
Patches
Vulnerability mechanics
References
4- www.mozilla.org/security/advisories/mfsa2026-86/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-87/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2026-88/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
News mentions
1- Mozilla Thunderbird: 16 Vulnerabilities Including Critical Sandbox Escapes Disclosed TogetherVypr Intelligence · Sep 1, 2026