CVE-2026-84641

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.15 Thunderbird versions prior to 153.2 Thunderbird versions prior to 155

Description A malicious IMAP server can trigger a use-after-free (a situation where a program continues to use a pointer after it has been freed) and heap-memory disclosure by sending a crafted ID response. This can result in heap contents being persisted to the prefs.js file.

Recommendations Update to version 140.15 or later. Update to version 153.2 or later. Update to version 155 or later.