CVE-2026-84637 Overview
CVE-2026-84637 is a vulnerability in Mozilla Thunderbird on Windows that allows malicious calendar invitations to launch local or network-hosted executables through file URI attachments. The flaw bypasses Thunderbird's normal executable attachment protections. When the new invitation display feature is enabled, the attachment can also appear under a misleading filename, aiding social engineering. Mozilla addressed the issue in Thunderbird 154 and Thunderbird 153.2. The vulnerability is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type.
Critical Impact
Remote attackers can trigger execution of arbitrary executables on Windows systems by delivering a crafted calendar invitation, achieving code execution without requiring traditional attachment warnings.
Affected Products
- Mozilla Thunderbird versions prior to 154
- Mozilla Thunderbird 153.x versions prior to 153.2
- Windows installations of Thunderbird (platform-specific issue)
Discovery Timeline
- 2026-09-01 - CVE-2026-84637 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84637
Vulnerability Analysis
The vulnerability resides in Thunderbird's handling of calendar invitation attachments on Windows. Thunderbird normally applies protections to executable attachments, warning users or restricting launch behavior. Calendar invitations accept attachments referenced by file URI schemes. Thunderbird's calendar processing path does not apply the same executable attachment safeguards used elsewhere in the client. As a result, an attacker-controlled file URI can point to a local path or a network-hosted binary reachable via SMB or WebDAV. The client can then launch that executable directly from the invitation interface.
The new invitation display, when enabled, renders the attachment with a caller-supplied filename. Attackers exploit this to present a benign filename such as agenda.pdf while the underlying URI resolves to an executable. The disconnect between displayed name and actual target enables reliable social engineering.
Root Cause
The root cause is missing validation of attachment types and URI schemes in the calendar invitation handler. The code path accepts file:// URIs without enforcing the executable attachment policy applied to standard email attachments. Filename display is decoupled from URI resolution, permitting spoofing.
Attack Vector
An attacker sends a crafted iCalendar invitation containing an attachment referenced by a file URI. The URI points to either a Windows local path or a UNC path such as \\attacker.example.com\share\payload.exe. When the recipient interacts with the attachment in the calendar view, Thunderbird invokes the executable through Windows without triggering the standard attachment warning. Refer to Mozilla Security Advisory MFSA-2026-78 and Mozilla Security Advisory MFSA-2026-88 for vendor detail. The underlying bug tracking entry is available at Mozilla Bug Report #2043878.
Detection Methods for CVE-2026-84637
Indicators of Compromise
- Inbound .ics or .eml messages containing ATTACH properties with file:// or UNC path values
- Outbound SMB or WebDAV connections from thunderbird.exe to untrusted hosts
- Child processes spawned by thunderbird.exe that map to executables in temp, user profile, or remote share paths
- Calendar invitation payloads where the displayed filename extension does not match the URI target extension
Detection Strategies
- Inspect mail gateway logs for iCalendar attachments referencing file URIs and quarantine those messages
- Correlate process creation events where thunderbird.exe is the parent and the child image resides on a network share
- Alert on Thunderbird versions below 154 or 153.2 reported by endpoint inventory
- Hunt for .ics files in mailbox stores that contain ATTACH; lines with file: or \\ prefixes
Monitoring Recommendations
- Enable Windows process creation auditing (Event ID 4688) with command-line logging on all Thunderbird hosts
- Monitor egress SMB (TCP 445) and WebDAV (TCP 80/443) traffic originating from mail client processes
- Track Thunderbird version distribution across the fleet through software inventory telemetry
How to Mitigate CVE-2026-84637
Immediate Actions Required
- Upgrade all Windows Thunderbird installations to version 154 or 153.2 or later without delay
- Block outbound SMB (TCP 445) traffic to external destinations at the perimeter firewall
- Configure mail gateways to strip or quarantine iCalendar attachments containing file:// or UNC references
- Disable the new invitation display feature on unpatched clients until updates are applied
Patch Information
Mozilla released fixes in Thunderbird 154 and Thunderbird 153.2. See Mozilla Security Advisory MFSA-2026-78 and Mozilla Security Advisory MFSA-2026-88 for release detail. Deploy the update through managed software distribution and verify version compliance on each endpoint.
Workarounds
- Block SMB and WebDAV egress from endpoint networks to prevent retrieval of remote payloads
- Apply Windows AppLocker or Windows Defender Application Control policies to restrict execution of binaries from network locations and user-writable paths
- Filter inbound .ics messages containing file: URIs at the mail security gateway
- Restrict Thunderbird calendar invitation auto-processing through enterprise policy until patching completes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
