CVE-2026-84641
Information disclosure due to malicious IMAP server response
CVE-2026-84641 is fixed in 135 products on 3 platforms, first by Mozilla Thunderbird 155.0, released August 28, 2026. It is not reported as exploited. Patch Radar priority: High.
HighFixed on 3 platforms
CVSS
7.5
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0027
18th percentile
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Windows apps | |||
| Mozilla Thunderbird (af) | 155.0 | Mozilla Thunderbird (af) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ar) | 155.0 | Mozilla Thunderbird (ar) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ast) | 155.0 | Mozilla Thunderbird (ast) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (be) | 155.0 | Mozilla Thunderbird (be) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (bg) | 155.0 | Mozilla Thunderbird (bg) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (br) | 155.0 | Mozilla Thunderbird (br) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ca) | 155.0 | Mozilla Thunderbird (ca) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (cak) | 155.0 | Mozilla Thunderbird (cak) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (cs) | 155.0 | Mozilla Thunderbird (cs) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (cy) | 155.0 | Mozilla Thunderbird (cy) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (da) | 155.0 | Mozilla Thunderbird (da) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (de) | 155.0 | Mozilla Thunderbird (de) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (dsb) | 155.0 | Mozilla Thunderbird (dsb) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (el) | 155.0 | Mozilla Thunderbird (el) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (en-CA) | 155.0 | Mozilla Thunderbird (en-CA) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (en-GB) | 155.0 | Mozilla Thunderbird (en-GB) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (en-US) | 155.0 | Mozilla Thunderbird (en-US) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (es-AR) | 155.0 | Mozilla Thunderbird (es-AR) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (es-ES) | 155.0 | Mozilla Thunderbird (es-ES) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (es-MX) | 155.0 | Mozilla Thunderbird (es-MX) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (et) | 155.0 | Mozilla Thunderbird (et) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (eu) | 155.0 | Mozilla Thunderbird (eu) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (fi) | 155.0 | Mozilla Thunderbird (fi) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (fr) | 155.0 | Mozilla Thunderbird (fr) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (fy-NL) | 155.0 | Mozilla Thunderbird (fy-NL) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ga-IE) | 155.0 | Mozilla Thunderbird (ga-IE) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (gd) | 155.0 | Mozilla Thunderbird (gd) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (gl) | 155.0 | Mozilla Thunderbird (gl) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (he) | 155.0 | Mozilla Thunderbird (he) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (hr) | 155.0 | Mozilla Thunderbird (hr) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (hsb) | 155.0 | Mozilla Thunderbird (hsb) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (hu) | 155.0 | Mozilla Thunderbird (hu) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (hy-AM) | 155.0 | Mozilla Thunderbird (hy-AM) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (id) | 155.0 | Mozilla Thunderbird (id) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (is) | 155.0 | Mozilla Thunderbird (is) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (it) | 155.0 | Mozilla Thunderbird (it) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ja) | 155.0 | Mozilla Thunderbird (ja) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ka) | 155.0 | Mozilla Thunderbird (ka) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (kab) | 155.0 | Mozilla Thunderbird (kab) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (kk) | 155.0 | Mozilla Thunderbird (kk) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ko) | 155.0 | Mozilla Thunderbird (ko) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (lt) | 155.0 | Mozilla Thunderbird (lt) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (lv) | 155.0 | Mozilla Thunderbird (lv) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ms) | 155.0 | Mozilla Thunderbird (ms) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (nb-NO) | 155.0 | Mozilla Thunderbird (nb-NO) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (nl) | 155.0 | Mozilla Thunderbird (nl) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (nn-NO) | 155.0 | Mozilla Thunderbird (nn-NO) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (pa-IN) | 155.0 | Mozilla Thunderbird (pa-IN) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (pl) | 155.0 | Mozilla Thunderbird (pl) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (pt-BR) | 155.0 | Mozilla Thunderbird (pt-BR) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (pt-PT) | 155.0 | Mozilla Thunderbird (pt-PT) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (rm) | 155.0 | Mozilla Thunderbird (rm) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ro) | 155.0 | Mozilla Thunderbird (ro) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (ru) | 155.0 | Mozilla Thunderbird (ru) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (sk) | 155.0 | Mozilla Thunderbird (sk) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (sl) | 155.0 | Mozilla Thunderbird (sl) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (sq) | 155.0 | Mozilla Thunderbird (sq) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (sr) | 155.0 | Mozilla Thunderbird (sr) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (sv-SE) | 155.0 | Mozilla Thunderbird (sv-SE) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (th) | 155.0 | Mozilla Thunderbird (th) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (tr) | 155.0 | Mozilla Thunderbird (tr) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (uk) | 155.0 | Mozilla Thunderbird (uk) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (uz) | 155.0 | Mozilla Thunderbird (uz) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (vi) | 155.0 | Mozilla Thunderbird (vi) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (zh-CN) | 155.0 | Mozilla Thunderbird (zh-CN) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird (zh-TW) | 155.0 | Mozilla Thunderbird (zh-TW) 155.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (af) | 153.2.0 | Mozilla Thunderbird ESR (af) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ar) | 153.2.0 | Mozilla Thunderbird ESR (ar) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ast) | 153.2.0 | Mozilla Thunderbird ESR (ast) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (be) | 153.2.0 | Mozilla Thunderbird ESR (be) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (bg) | 153.2.0 | Mozilla Thunderbird ESR (bg) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (br) | 153.2.0 | Mozilla Thunderbird ESR (br) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ca) | 153.2.0 | Mozilla Thunderbird ESR (ca) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (cak) | 153.2.0 | Mozilla Thunderbird ESR (cak) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (cs) | 153.2.0 | Mozilla Thunderbird ESR (cs) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (cy) | 153.2.0 | Mozilla Thunderbird ESR (cy) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (da) | 153.2.0 | Mozilla Thunderbird ESR (da) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (de) | 153.2.0 | Mozilla Thunderbird ESR (de) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (dsb) | 153.2.0 | Mozilla Thunderbird ESR (dsb) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (el) | 153.2.0 | Mozilla Thunderbird ESR (el) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (en-CA) | 153.2.0 | Mozilla Thunderbird ESR (en-CA) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (en-GB) | 153.2.0 | Mozilla Thunderbird ESR (en-GB) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (en-US) | 153.2.0 | Mozilla Thunderbird ESR (en-US) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (es-AR) | 153.2.0 | Mozilla Thunderbird ESR (es-AR) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (es-ES) | 153.2.0 | Mozilla Thunderbird ESR (es-ES) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (es-MX) | 153.2.0 | Mozilla Thunderbird ESR (es-MX) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (et) | 153.2.0 | Mozilla Thunderbird ESR (et) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (eu) | 153.2.0 | Mozilla Thunderbird ESR (eu) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (fi) | 153.2.0 | Mozilla Thunderbird ESR (fi) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (fr) | 153.2.0 | Mozilla Thunderbird ESR (fr) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (fy-NL) | 153.2.0 | Mozilla Thunderbird ESR (fy-NL) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ga-IE) | 153.2.0 | Mozilla Thunderbird ESR (ga-IE) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (gd) | 153.2.0 | Mozilla Thunderbird ESR (gd) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (gl) | 153.2.0 | Mozilla Thunderbird ESR (gl) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (he) | 153.2.0 | Mozilla Thunderbird ESR (he) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (hr) | 153.2.0 | Mozilla Thunderbird ESR (hr) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (hsb) | 153.2.0 | Mozilla Thunderbird ESR (hsb) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (hu) | 153.2.0 | Mozilla Thunderbird ESR (hu) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (hy-AM) | 153.2.0 | Mozilla Thunderbird ESR (hy-AM) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (id) | 153.2.0 | Mozilla Thunderbird ESR (id) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (is) | 153.2.0 | Mozilla Thunderbird ESR (is) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (it) | 153.2.0 | Mozilla Thunderbird ESR (it) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ja) | 153.2.0 | Mozilla Thunderbird ESR (ja) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ka) | 153.2.0 | Mozilla Thunderbird ESR (ka) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (kab) | 153.2.0 | Mozilla Thunderbird ESR (kab) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (kk) | 153.2.0 | Mozilla Thunderbird ESR (kk) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ko) | 153.2.0 | Mozilla Thunderbird ESR (ko) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (lt) | 153.2.0 | Mozilla Thunderbird ESR (lt) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (lv) | 153.2.0 | Mozilla Thunderbird ESR (lv) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ms) | 153.2.0 | Mozilla Thunderbird ESR (ms) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (nb-NO) | 153.2.0 | Mozilla Thunderbird ESR (nb-NO) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (nl) | 153.2.0 | Mozilla Thunderbird ESR (nl) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (nn-NO) | 153.2.0 | Mozilla Thunderbird ESR (nn-NO) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (pa-IN) | 153.2.0 | Mozilla Thunderbird ESR (pa-IN) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (pl) | 153.2.0 | Mozilla Thunderbird ESR (pl) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (pt-BR) | 153.2.0 | Mozilla Thunderbird ESR (pt-BR) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (pt-PT) | 153.2.0 | Mozilla Thunderbird ESR (pt-PT) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (rm) | 153.2.0 | Mozilla Thunderbird ESR (rm) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ro) | 153.2.0 | Mozilla Thunderbird ESR (ro) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (ru) | 153.2.0 | Mozilla Thunderbird ESR (ru) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (sk) | 153.2.0 | Mozilla Thunderbird ESR (sk) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (sl) | 153.2.0 | Mozilla Thunderbird ESR (sl) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (sq) | 153.2.0 | Mozilla Thunderbird ESR (sq) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (sr) | 153.2.0 | Mozilla Thunderbird ESR (sr) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (sv-SE) | 153.2.0 | Mozilla Thunderbird ESR (sv-SE) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (th) | 153.2.0 | Mozilla Thunderbird ESR (th) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (tr) | 153.2.0 | Mozilla Thunderbird ESR (tr) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (uk) | 153.2.0 | Mozilla Thunderbird ESR (uk) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (uz) | 153.2.0 | Mozilla Thunderbird ESR (uz) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (vi) | 153.2.0 | Mozilla Thunderbird ESR (vi) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (zh-CN) | 153.2.0 | Mozilla Thunderbird ESR (zh-CN) 153.2.0 | Sep 1, 2026 |
| Mozilla Thunderbird ESR (zh-TW) | 153.2.0 | Mozilla Thunderbird ESR (zh-TW) 153.2.0 | Sep 1, 2026 |
| macOS | |||
| Mozilla Thunderbird | 155.0 | Mozilla Thunderbird 155.0 | Aug 28, 2026 |
| Linux | |||
| MozillaThunderbird · sles 15.7 | 153.2.0-150400.13.3.1 | SUSE-SU-2026:4268-1 | Sep 18, 2026 |
| thunderbird · Debian 12.15 (bookworm) | 1:140.15.0esr-1~deb12u1 | DEBIAN-CVE-2026-84641 | Sep 5, 2026 |
| thunderbird · Debian 13.5 (trixie) | 1:140.15.0esr-1~deb13u1 | DEBIAN-CVE-2026-84641 | Sep 5, 2026 |
| thunderbird · Debian 14 | 1:153.2.0esr-1 | DEBIAN-CVE-2026-84641 | Sep 5, 2026 |
| thunderbird · RHEL 10 | 140.15.0-1.el10_0 | RHSA-2026:77631 | Sep 30, 2026 |
| thunderbird · RHEL 8 | 0:140.16.0-1.el8_10 | RHSA-2026:73971 | Oct 1, 2026 |
| thunderbird · RHEL 9 | 0:140.16.0-1.el9_8 | RHSA-2026:70642 | Sep 24, 2026 |
| thunderbird · almalinux 10 | 140.16.0-1.el10_2.alma.1 | ALSA-2026:73130 | Sep 29, 2026 |
| thunderbird · almalinux 8 | 140.16.0-1.el8_10.alma.1 | ALSA-2026:73971 | Sep 30, 2026 |
| thunderbird · almalinux 9 | 140.16.0-1.el9_8.alma.1 | ALSA-2026:70642 | Sep 23, 2026 |
| thunderbird · ol 10 | 0:140.16.0-1.0.1.el10_2 | ELSA-2026-73130 | Sep 29, 2026 |
| thunderbird · ol 8 | 0:140.16.0-1.0.1.el8_10 | ELSA-2026-73971 | Oct 1, 2026 |
| thunderbird · ol 9 | 0:140.16.0-1.0.1.el9_8 | ELSA-2026-70642 | Sep 24, 2026 |
| thunderbird · rocky 10 | 0:140.16.0-1.el10_2 | RLSA-2026:73130 | Sep 30, 2026 |
| thunderbird · rocky 8 | 0:140.16.0-1.el8_10 | RLSA-2026:73971 | Oct 1, 2026 |
| thunderbird · rocky 9 | 0:140.16.0-1.el9_8 | RLSA-2026:70642 | Sep 25, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.