CVE-2026-84641
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 01, 2026
Vendor
unknown
Description
A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.