PT-2026-84528
CVE-2026-84642
·
Published
2026-09-01
·
Updated
2026-10-10
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Thunderbird versions prior to 153.2
Thunderbird versions prior to 155
Description
The
mail.allowed attachment hostnames advanced configuration setting is used in a regular expression without proper escaping. This flaw allows certain unintended hostnames to match the expression, potentially enabling the serving of remote attachments from unauthorized hosts.Recommendations
Update Thunderbird to version 153.2 or later.
Update Thunderbird to version 155 or later.
Found an issue in the description? Have something to add? Feel free to write us 👾