CVE-2026-84641: Thunderbird Use-After-Free Vulnerability

CVE-2026-84641 Overview

CVE-2026-84641 is a use-after-free vulnerability [CWE-416] in Mozilla Thunderbird that a malicious IMAP server can trigger by returning a crafted ID response. The flaw leads to heap-memory disclosure, and leaked contents may be persisted to the client's prefs.js file. Mozilla resolved the issue in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Critical Impact
A hostile or compromised IMAP server can read heap memory from a connected Thunderbird client and cause fragments of that memory to be written to disk in prefs.js, enabling persistent exposure of sensitive process data.

Affected Products

Mozilla Thunderbird versions prior to 140.15 (ESR)
Mozilla Thunderbird versions prior to 153.2
Mozilla Thunderbird versions prior to 155

Discovery Timeline

2026-09-01 - CVE-2026-84641 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84641

Vulnerability Analysis

The vulnerability affects Thunderbird's IMAP client code path that handles the server's response to the IMAP ID command, defined in RFC 2971. When a Thunderbird client connects to an IMAP account, the client and server may exchange identification metadata such as name, version, and vendor. A malicious server can return a crafted ID response that causes Thunderbird to access a heap object after it has been freed.

The use-after-free condition allows the freed memory region to be reused before the stale pointer is dereferenced. Reading through that stale pointer discloses arbitrary heap contents to the IMAP parsing logic. Because Thunderbird stores certain server-provided identification strings in preferences, the disclosed bytes can be written into prefs.js and persisted across restarts.

Root Cause

The root cause is improper object lifetime management in the IMAP ID response parser. A referenced buffer or object is released while a code path still holds and later uses the pointer. The condition maps to [CWE-416: Use After Free].

Attack Vector

Exploitation requires the victim to connect Thunderbird to an attacker-controlled IMAP server or to a legitimate server that has been compromised or subject to a network man-in-the-middle position. No user interaction beyond configuring or opening the account is required, and the attack is fully network-based. See the Mozilla Bug Report #2057805 for technical details.

No verified proof-of-concept code is publicly available. The vulnerability manifests during parsing of the IMAP ID command response; see the Mozilla Security Advisory MFSA-2026-86 for vendor details.

Detection Methods for CVE-2026-84641

Indicators of Compromise

Unexpected or malformed string values appearing in Thunderbird prefs.js under IMAP server identification preferences.
Thunderbird crashes or memory-safety diagnostics logged shortly after establishing an IMAP session.
Outbound IMAP connections from user endpoints to unfamiliar or newly registered mail servers.

Detection Strategies

Inventory Thunderbird installations across the environment and flag versions earlier than 140.15, 153.2, and 155.
Inspect prefs.js files on managed endpoints for non-ASCII or binary-like content in preferences tied to IMAP server capabilities and identity.
Correlate mail-client process telemetry with destination IMAP hosts to identify connections that fall outside the sanctioned mail provider list.

Monitoring Recommendations

Log and review IMAP session endpoints from user workstations at the network egress layer.
Monitor for modifications to Thunderbird profile directories, especially unexpected writes to prefs.js after mail synchronization events.
Alert on Thunderbird process crashes recorded in the operating system's crash telemetry to surface potential exploitation attempts.

How to Mitigate CVE-2026-84641

Immediate Actions Required

Upgrade Thunderbird to version 140.15, 153.2, or 155 across all managed endpoints.
Restrict Thunderbird accounts to trusted IMAP providers and block outbound IMAP to arbitrary internet hosts where policy allows.
Audit existing prefs.js files for suspicious IMAP identity strings and reset affected preferences.

Patch Information

Mozilla addressed the vulnerability in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. Refer to Mozilla Security Advisory MFSA-2026-86, Mozilla Security Advisory MFSA-2026-87, and Mozilla Security Advisory MFSA-2026-88 for release-specific fix details.

Workarounds

Require IMAP over TLS with certificate validation to reduce the risk of a network attacker impersonating a trusted mail server.
Use enterprise policy to lock Thunderbird account configuration to approved mail hosts.
Where upgrade is delayed, disable IMAP accounts in Thunderbird and use webmail or POP3 until the patch is applied.

bash

# Configuration example: enforce Thunderbird IMAP over TLS via policies.json
# Place in the Thunderbird distribution directory
{
  "policies": {
    "DisableAppUpdate": false,
    "BlockAboutConfig": true,
    "Preferences": {
      "mail.server.default.socketType": { "Value": 3, "Status": "locked" },
      "mail.server.default.authMethod": { "Value": 10, "Status": "locked" }
    }
  }
}