VulnSocial

CVE-2026-84637Disclosure(mozilla / thunderbird)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch mozilla thunderbird systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

mozilla CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • thunderbird

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-03); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
mozilla
Products
thunderbird

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-03: 1Mentions · 2026-10-01: 1Patch / Workaround · 2026-10-01: 1Technical Details · 2026-09-03: 1Technical Details · 2026-10-01: 109-0310-01
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-031
Disclosure1
2026-10-011
Patch1
Full discourse2 posts
  • CyStack@CyStackSecurity
    Patch

    CVE-2026-84637: Thunderbird calendar invitations could launch executables on Windows. A file URI attachment in a malicious invite bypasses Thunderbird's executable attachment protections and can show a misleading filename. The victim opens the invite, the attacker runs arbitrary programs. Patched in v153.2. Found by a CyStack researcher. Details at https://cystack.net/disclosures #CyStack #CyberSecurity #Vulnerability #Mozilla #Thunderbird #InfoSec

    Post summary

    Thunderbird calendar invites with malicious file URI attachments bypass executable protections to run arbitrary code on Windows, with a patch released in v153.2.

    0001074
    3.7K followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #endpointsecurity Thunderbird-Fehler CVE-2026-84637 erlaubt Angriff über Kalender-Einladungen #cve202684637 #mozillathunderbird #windows https://cybersecurity-news.de/cve-2026-84637-thunderbird-kalender-einladungen-windows-programme-starten

    Post summary

    The tweet announces that CVE-2026-84637 in Thunderbird enables attackers to exploit the calendar‑invitation feature on Windows systems.

    0000034
    10 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmozillathunderbird---

Explore more

Back to dashboardmozilla CVEsthunderbird vulnerabilities