{"id":"CVE-2026-84637","aliases":["EUVD-2026-69703","GHSA-3q74-4f83-x4rj","MGASA-2026-0388","SUSE-SU-2026:4268-1","UBUNTU-CVE-2026-84637","openSUSE-SU-2026:12098-1"],"status":"published","title":"Calendar invitation attachments could launch local executables","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00626,"percentile":0.50476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2026-09-01T21:25:08Z","modified":"2026-10-17T13:01:13Z","affected":[{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.2.0-1.mga10"}]}],"bundled":31},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.2.0-1.mga10"}]}],"bundled":31},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.15.0-1.mga9"}]}],"bundled":31},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.15.0-1.mga9"}]}],"bundled":31},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.2.0-150400.13.3.1"}]}],"bundled":143},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.2.0-150400.13.3.1"}]}],"bundled":143},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:115.3.1+build1-0ubuntu1","1:115.4.1+build1-0ubuntu1","1:115.4.3+build1-0ubuntu1","1:115.5.0+build1-0ubuntu1","1:115.5.1+build1-0ubuntu1","1:115.5.2+build2-0ubuntu1","1:115.6.0+build1-0ubuntu1","1:115.6.0+build2-0ubuntu1","1:115.6.1+build1-0ubuntu1","1:115.8.0+build1-0ubuntu1","1:115.8.1+build1+snap2","1:115.8.1+build1+snap3","2:1snap1-0ubuntu1","2:1snap1-0ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1snap1-0ubuntu3","2:1snap1-0ubuntu4","2:1snap1-0ubuntu5"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.4.0-1.1"}]}],"bundled":138}],"products":[{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2043878","tags":["Permissions Required"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-78/","tags":["Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-88/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84637"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-78"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-88"},{"url":"https://github.com/advisories/GHSA-3q74-4f83-x4rj"},{"url":"https://advisories.mageia.org/MGASA-2026-0388.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36245","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.14.1esr/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.1.1esr/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.15.0esr/releasenotes/","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/153.2.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-87/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-88/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264268-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271649","tags":["report"]},{"url":"https://bugzilla.suse.com/1274867","tags":["report"]},{"url":"https://bugzilla.suse.com/1278001","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74953","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74961","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-74990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84119","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84137","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84642","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-84637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84637","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-78/#CVE-2026-84637","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-100832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-103500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92048","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92055","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-92079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-96869","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-84637","title":"Calendar invitation attachments could launch local executables","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","status":"published","published":"2026-09-01T21:25:08.554Z","modified":"2026-09-02T18:49:58.962Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-69703","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","status":"published","published":"2026-09-01T21:25:08Z","modified":"2026-09-02T18:49:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:01:14.689075Z"}],"ghsa":[{"id":"GHSA-3q74-4f83-x4rj","title":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted...","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","status":"published","published":"2026-09-02T00:31:29Z","modified":"2026-09-02T21:32:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:11:17.943368Z"}],"nvd":[{"id":"CVE-2026-84637","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","status":"published","published":"2026-09-01T22:17:19.597Z","modified":"2026-09-03T19:02:08.287Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:12:43.04945Z"}],"osv":[{"id":"UBUNTU-CVE-2026-84637","description":"Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.","status":"published","published":"2026-09-01T22:17:00Z","modified":"2026-10-17T13:01:13.193219793Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"MGASA-2026-0388","title":"Updated thunderbird packages fix security vulnerabilities","description":"Uninitialized memory in MIME parsing. (CVE-2026-84639)\nOne byte overflow read in mail parser. (CVE-2026-84640)\nInformation disclosure due to malicious IMAP server response.\n(CVE-2026-84641)\nCalendar invitation attachments could launch local executables.\n(CVE-2026-84637)\nAllowed UNC hostnames for attachments interpreted as a regular\nexpression. (CVE-2026-84642)\nSandbox escape in the Remote Settings Client component. (CVE-2026-75874)\nPrivilege escalation in the DOM: Workers component. (CVE-2026-16365)\nUse-after-free in the JavaScript: GC component. (CVE-2026-84118)\nSandbox escape due to use-after-free in the DOM: Navigation component.\n(CVE-2026-84119)\nUse-after-free in the Audio/Video component. (CVE-2026-84120)\nSandbox escape due to use-after-free in the DOM: Security component.\n(CVE-2026-84121)\nUse-after-free in the Audio/Video component. (CVE-2026-84122)\nPrivilege escalation due to use-after-free in the Graphics: WebGPU\ncomponent. (CVE-2026-84123)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-84124)\nUse-after-free in the DOM: Core \u0026 HTML component. (CVE-2026-84125)\nPrivilege escalation in the DOM: Navigation component. (CVE-2026-16371)\nPrivilege escalation in the Application Update component.\n(CVE-2026-74952)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-84129)\nInformation disclosure in the Graphics: WebGPU component.\n(CVE-2026-84130)\nPrivilege escalation due to invalid pointer in the Graphics component.\n(CVE-2026-84131)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-84132)\nSite isolation issue in the DOM: Push Subscriptions component.\n(CVE-2026-84133)\nOther issue in the Profile Backup component. (CVE-2026-84134)\nOther issue in the DOM: Navigation component. (CVE-2026-84136)\nSpoofing issue in the DOM: Core \u0026 HTML component. (CVE-2026-84137)\nClickjacking issue in the DOM: Events component. (CVE-2026-84139)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-84140)\nInteger overflow in the Graphics: ImageLib component. (CVE-2026-84141)\nInternally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2\nand Thunderbird ESR 140.15. (CVE-2026-84143)\nInternally found bugs fixed in Thunderbird 155 and Thunderbird ESR\n153.2. (CVE-2026-84144)\nInternally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2\nand Thunderbird ESR 140.15. (CVE-2026-84145)\n","status":"published","published":"2026-09-09T18:01:33Z","modified":"2026-09-09T18:27:30.09117019Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12098-1","title":"MozillaThunderbird-153.4.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-153.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-10T00:00:00Z","modified":"2026-10-11T12:45:03.85762477Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4268-1","title":"Security update for MozillaThunderbird","description":"This update for MozillaThunderbird fixes the following issues:\n\nMozilla Thunderbird 153.2:\n\n  * fixed: Deleting an Exchange account retained the outgoing\n    server settings \n  * fixed: Thunderbird upgrade disabled Settings menu for\n    versions before macOS 13 \n  * fixed: Windows jump list menu no longer functioned correctly\n  * fixed: Security fixes MFSA 2026-88 (bsc#1278001):\n  * CVE-2026-84639 \n    Uninitialized memory in MIME parsing\n  * CVE-2026-84640 \n    One byte overflow read in mail parser\n  * CVE-2026-84641 \n    Information disclosure due to malicious IMAP server response\n  * CVE-2026-84637 \n    Calendar invitation attachments could launch local\n    executables\n  * CVE-2026-84642 \n    Allowed UNC hostnames for attachments interpreted as a\n    regular expression\n  * CVE-2026-75874 \n    Sandbox escape in the Remote Settings Client component\n  * CVE-2026-84118 \n    Use-after-free in the JavaScript: GC component\n  * CVE-2026-84119 \n    Sandbox escape due to use-after-free in the DOM: Navigation\n    component\n  * CVE-2026-84120 \n    Use-after-free in the Audio/Video component\n  * CVE-2026-84121 \n    Sandbox escape due to use-after-free in the DOM: Security\n    component\n  * CVE-2026-84122 \n    Use-after-free in the Audio/Video component\n  * CVE-2026-84123 \n    Privilege escalation due to use-after-free in the Graphics:\n    WebGPU component\n  * CVE-2026-84124 \n    Use-after-free in the DOM: Core \u0026 HTML component\n  * CVE-2026-84125 \n    Use-after-free in the DOM: Core \u0026 HTML component\n  * CVE-2026-74952 \n    Privilege escalation in the Application Update component\n  * CVE-2026-84129 \n    Site isolation issue in the DOM: Navigation component\n  * CVE-2026-84130 \n    Information disclosure in the Graphics: WebGPU component\n  * CVE-2026-84131 \n    Privilege escalation due to invalid pointer in the Graphics\n    component\n  * CVE-2026-84132 \n    Information disclosure in the Networking: HTTP component\n  * CVE-2026-84133 \n    Site isolation issue in the DOM: Push Subscriptions component\n  * CVE-2026-84134 \n    Other issue in the Profile Backup component\n  * CVE-2026-84136 \n    Other issue in the DOM: Navigation component\n  * CVE-2026-84137 \n    Spoofing issue in the DOM: Core \u0026 HTML component\n  * CVE-2026-84139 \n    Clickjacking issue in the DOM: Events component\n  * CVE-2026-84140 \n    Site isolation issue in the DOM: Navigation component\n  * CVE-2026-84141 \n    Integer overflow in the Graphics: ImageLib component\n  * CVE-2026-84143 \n    Internally found bugs fixed in Thunderbird 155, Thunderbird\n    ESR 153.2 and Thunderbird ESR 140.15\n  * CVE-2026-84144 \n    Internally found bugs fixed in Thunderbird 155 and\n    Thunderbird ESR 153.2\n  * CVE-2026-84145 \n    Internally found bugs fixed in Thunderbird 155, Thunderbird\n    ESR 153.2 and Thunderbird ESR 140.15\n\n- Mozilla Thunderbird 153.1.1\n\n  * fixed: Thunderbird upgrade disabled composition toolbar\n  * fixed: Draft was not preserved when encrypted message send\n    failed \n  * fixed: Account Hub prompted for calendar credentials after\n    successful login \n  * fixed: Thunderbird crash fixes \n  * fixed: Folder compaction showed incorrect disk space recovery\n    estimates \n  * fixed: Thunderbird failed to launch GPU process \n\n- Mozilla Thunderbird 153.1\n\n  * fixed: Autoscroll icon was missing directional arrows in\n    scrollable messages \n  * fixed: Security fixes MFSA 2026-80 (bsc#1274867):\n  * CVE-2026-74934 \n    Site isolation issue in the Graphics: CanvasWebGL component\n  * CVE-2026-74935 \n    Privilege escalation in the DOM: Networking component\n  * CVE-2026-74936 \n    Use-after-free in the JavaScript: WebAssembly component\n  * CVE-2026-74937 \n    Use-after-free in the JavaScript: GC component\n  * CVE-2026-74938 \n    Mitigation bypass in the JavaScript: GC component\n  * CVE-2026-74939 \n    Privilege escalation in the DOM: Navigation component\n  * CVE-2026-74940 \n    Use-after-free in the Graphics: Text component\n  * CVE-2026-74941 \n    Privilege escalation in the Graphics: CanvasWebGL component\n  * CVE-2026-74942 \n    Privilege escalation in the Remote Settings Client component\n  * CVE-2026-74943 \n    Use-after-free in the Graphics: ImageLib component\n  * CVE-2026-74944 \n    Use-after-free in the DOM: Core \u0026 HTML component\n  * CVE-2026-74945 \n    Information disclosure in the Graphics: Text component\n  * CVE-2026-74946 \n    Privilege escalation due to incorrect boundary conditions in\n    the Graphics: CanvasWebGL component\n  * CVE-2026-74947 \n    Privilege escalation due to invalid pointer in the Graphics\n    component\n  * CVE-2026-74948 \n    Information disclosure in the Graphics component\n  * CVE-2026-74949 \n    Privilege escalation due to use-after-free in the Graphics:\n    Canvas2D component\n  * CVE-2026-74950 \n    Privilege escalation in the Downloads API component\n  * CVE-2026-74953 \n    Privilege escalation in the Networking: Cookies component\n  * CVE-2026-74954 \n    Information disclosure due to side-channel in the Storage:\n    Cache API component\n  * CVE-2026-74955 \n    Privilege escalation in the Request Handling component\n  * CVE-2026-74956 \n    Same-origin policy bypass in the DOM: Service Workers\n    component\n  * CVE-2026-74957 \n    Mitigation bypass in the Safe Browsing component\n  * CVE-2026-74958 \n    Information disclosure in the WebRTC component\n  * CVE-2026-74959 \n    Mitigation bypass in the Storage: Cache API component\n  * CVE-2026-74960 \n    Site isolation issue in the WebExtensions component\n  * CVE-2026-74961 \n    Side-channel in the Web Audio component\n  * CVE-2026-74962 \n    Site isolation issue in the Networking: Cookies component\n  * CVE-2026-74963 \n    Same-origin policy bypass in the Networking: Cookies\n    component\n  * CVE-2026-74964 \n    Integer overflow in the Graphics component\n  * CVE-2026-74965 \n    Privilege escalation in the Shell Integration component\n  * CVE-2026-74966 \n    Information disclosure in the Form Autofill component\n  * CVE-2026-74967 \n    Same-origin policy bypass in the Audio/Video: Playback\n    component\n  * CVE-2026-74968 \n    Site isolation issue in the Graphics: WebRender component\n  * CVE-2026-74969 \n    Use-after-free in the Layout: Text and Fonts component\n  * CVE-2026-74970 \n    Site isolation issue in the Graphics component\n  * CVE-2026-74971 \n    Information disclosure in the DOM: UI Events \u0026 Focus Handling\n    component\n  * CVE-2026-74972 \n    Information disclosure in the DOM: Push Subscriptions\n    component\n  * CVE-2026-74973 \n    Race condition, use-after-free in the Graphics component\n  * CVE-2026-74974 \n    Same-origin policy bypass in the Graphics: ImageLib component\n  * CVE-2026-74976 \n    JIT miscompilation in the JavaScript Engine: JIT component\n  * CVE-2026-74977 \n    Integer overflow in the Graphics component\n  * CVE-2026-74978 \n    Clickjacking issue in the Widget component\n  * CVE-2026-74979 \n    Mitigation bypass in the Add-ons Manager component\n  * CVE-2026-74981 \n    Site isolation issue in the Audio/Video: Web Codecs component\n  * CVE-2026-74982 \n    Denial-of-service in the Widget component\n  * CVE-2026-74983 \n    Mitigation bypass in the Data Loss Prevention component\n  * CVE-2026-74984 \n    Race condition in the JavaScript Engine component\n  * CVE-2026-74985 \n    Privilege escalation in the Enterprise Policies component\n  * CVE-2026-74986 \n    Site isolation issue in the CSS Parsing and Computation\n    component\n  * CVE-2026-74987 \n    Internally found bugs fixed in Thunderbird ESR 140.14,\n    Thunderbird ESR 153.1 and Thunderbird 154\n  * CVE-2026-74988 \n    Internally found bugs fixed in Thunderbird ESR 153.1 and\n    Thunderbird 154\n  * CVE-2026-74990 \n    Internally found bugs fixed in Thunderbird ESR 140.14,\n    Thunderbird ESR 153.1 and Thunderbird 154\n\n- Mozilla Thunderbird 153.0.3\n\n  * fixed: Dragging attachments from Local Folders to the desktop\n    failed on Windows \n  * fixed: IMAP tags did not sync automatically across clients\n  * fixed: DisablePasswordReveal policy failed to prevent\n    revealing saved passwords \n  * fixed: Thunderbird could crash when saving a sent Exchange\n    message \n\n- Mozilla Thunderbird 153.0.2\n\n  * changed: Restored previous Yahoo sign-in flow to improve\n    login reliability \n  * fixed: Edit Calendar dialog opened without a window title\n  * fixed: Thunderbird could crash when going offline with active\n    IMAP connection \n\n- Mozilla Thunderbird 153.0.1\n\n  * changed: There are no Thunderbird changes requiring release\n    notes in this release\n\n- Mozilla Thunderbird 153\n\n  MFSA 2026-71 (bsc#1271649):\n  * new: Visual signatures can be added to PDF attachments opened\n    in Thunderbird \n  * new: 'Copy Message Link' and 'Copy News Link' added to header\n    pane 'More actions' \n  * new: Accessiblity is improved in various tree views\n  * new: Added 'Archive' action to mail notifications\n  * new: Add 'Show Full Path' folder pane option for compact view\n    modes \n  * new: Unified folders now display account color indicator with\n    account name tooltip \n  * new: Folder copy enabled within mail server accounts and\n    local folders \n  * new: 'Reset Folder Order' option added to folder pane to\n    reset custom folder sorting \n  * new: Add `mail.useLocalizedFolderNames' to toggle special\n    folder name localization \n  * new: 'Favorites' added as destination for 'Move To' and\n    'File' buttons \n  * new: Composer now shows a warning if user's configured\n    OpenPGP key expires soon \n  * new: Enabled configuration of preferred OpenPGP keyserver via\n    the UI \n  * new: Add `mail.openpgp.load_untested_gpgme_version` to load\n    untested GPGME version \n  * new: Added support for generating Unobtrusive Signatures\n    (OpenPGP) \n  * new: Implemented option to show only messages without any tag\n  * new: Message body search enabled for OpenPGP and S/MIME\n    encrypted messages \n  * new: SecurityDevices enabled in enterprise policies\n  * new: Enable support for DNS over HTTPS \n  * new: OAuth login for mail accounts now opens in default web\n    browser \n  * new: Thundermail services can now be used without installing\n    an add-on \n  * new: OAuth responses now verify issuer fields and reject\n    missing required issuers \n  * new: Enable the 'Sign in with Thundermail' button in Account\n    Hub \n  * new: Account hub is opened on the first run of Thunderbird\n  * new: Account Hub email manual config option added\n  * new: Enable Thundermail OAuth sign-in with account auto-\n    configuration \n  * new: Address book cards can be copied to the clipboard as\n    vCard \n  * new: Enable exporting selected address book cards \n  * new: Custom Accent Color can be chosen in Appearance Settings\n  * new: Enable support for Microsoft Exchange via Exchange Web\n    Services \n  * new: Calendar month/multiweek views are now scrollable with\n    touch screen \n  * new: Tasks can be sorted by created or modified date\n  * new: PDF pages can be reorganized directly in the PDF viewer\n  * changed: 'Copy Message Location' removed from mail context\n    menu \n  * changed: Read folders are now removed from Unread Folders\n    view \n  * changed: Special folders are now localized based on a\n    restricted set of names \n  * changed: OpenPGP public key no longer attached by default in\n    signed-only messages \n  * changed: Address books are now created in Account Hub\n  * changed: Yahoo, AT\u0026T, AOL accounts migrated to OAuth 2.0 with\n    PKCE for improved security \n  * changed: GMail OAuth updated to use PKCE \n  * changed: Skype has been retired and therefore dropped from\n    Address book IM selection \n  * changed: Removed pref `default_supports_diskspace.{HOST}`\n  * changed: Removed pref `default_offline_support_level.{HOST}`\n  * changed: Removed Odnoklassniki chat setup and directed users\n    to XMPP configuration \n  * changed: Use of the string 'Junk' has been replaced with\n    'Spam' \n  * changed: Updated about:rights to replace local with hosted\n    url \n  * changed: Stop shipping 32-bit Linux x86 binaries\n  * changed: 'Hide completed tasks' now also hides cancelled\n    tasks \n  * changed: Stop shipping 32-bit Linux x86 binaries\n  * fixed: Thunderbird could crash when parsing message state\n  * fixed: The English string for the Angry emoji was incorrectly\n    named as the Yell emoji \n  * fixed: Notification sounds did not respect operating system's\n    do-not-disturb mode \n  * fixed: Non-English localized Thunderbird created English\n    special folders on first start \n  * fixed: Copying text from some error alerts was not possible\n  * fixed: Fastmail CalDAV app password access failed due to\n    forced OAuth regression \n  * fixed: Thunderbird could crash in server subscription logic\n  * fixed: Could not distinguish folders with same name in\n    'Recent Destinations' and 'Favorites' \n  * fixed: Donation banner stole focus when Thunderbird was\n    running in the background \n  * fixed: Unknown command-line arguments passed to Thunderbird\n    did not print warning \n  * fixed: Thunderbird could crash when processing new incoming\n    messages \n  * fixed: Spam messages triggered new mail notifications before\n    being moved to Spam folder \n  * fixed: Web pages with bad certificates displayed as blank\n  * fixed: Memory leak after opening New Window from folder pane\n    context menu \n  * fixed: Importing a vCard only displayed VCF files in the file\n    picker \n  * fixed: Calendar view tabs were not properly keyboard\n    accessible \n  * fixed: Ctrl+S did not save PDF attachments opened in\n    Thunderbird tabs \n  * fixed: TLS errors incorrectly reported all unknown failures\n    as untrusted certificates \n  * fixed: Thunderbird could crash when copying an empty list of\n    messages \n  * fixed: Incorrect roaming data directory caused regression on\n    Windows and macOS \n  * fixed: Changing to new drafts folder and then back did not\n    correctly restore the folder \n  * fixed: Message headers were re-downloaded at every startup\n  * fixed: Old IMAP profile migration deleted INBOX and other\n    mailbox files \n  * fixed: 'Search Messages...' dialog could not be opened\n    outside the email tab \n  * fixed: Option did not exist to create new address book under\n    File -\u003e New \n  * fixed: Newly created folder was missing under 'Recent' when\n    moving a message \n  * fixed: Could not compose new message if the folder pane was\n    empty \n  * fixed: 'Delete' was missing from context menu when multiple\n    IMAP folders were selected \n  * fixed: Compacting multiple folders failed and did not compact\n  * fixed: Shift-click for 'Edit' button in drafts header view\n    did not work \n  * fixed: 'Replace All' in Compose did not update plain text\n    until dialog closed \n  * fixed: Status bar messages displayed unlocalized folder names\n    or IMAP mailbox names \n  * fixed: Saved email filenames were not not always cross-\n    platform safe \n  * fixed: Space bar did not scroll in PDF attachments opened\n    from emails \n  * fixed: Folder location widget used non-localised name\n  * fixed: Empty confirmation dialog when more messages opened in\n    tabs than `mailnews.open_tab_warning` \n  * fixed: Removing tags from IMAP messages could fail and tags\n    reappeared after refresh \n  * fixed: Toggling dark message mode did not restore focus and\n    scroll position \n  * fixed: 'Show remote content' did not display remote content\n    for EML message \n  * fixed: Emoji sequences were not properly handled in subject\n    lines \n  * fixed: 'Delete' button in unified toolbar could delete\n    attachments instead of message \n  * fixed: 'Repair text encoding' could duplicate recipient and\n    attachments \n  * fixed: Some IMAP emails showed current time instead of\n    correct received date \n  * fixed: Deleting a single message in folder using 'Group by\n    Sort' failed after CTRL+A \n  * fixed: New newsgroups were not added in alphabetical order by\n    default \n  * fixed: Sorting by threads only brought threads with unread\n    top messages to the top \n  * fixed: News message marked read after NNTP error prevented\n    retrieval from server \n  * fixed: 'Recent destinations' submenu was not sorted by time\n    of modification \n  * fixed: Account column could display incorrect account name\n  * fixed: 'Tag' submenu of mail context menu could be populated\n    incorrectly \n  * fixed: Unified archive subfolders could show wrong names and\n    no messages \n  * fixed: Moving saved search/virtual folder under IMAP could\n    fail \n  * fixed: New Folder dialog allowed invalid folder creation\n    without a selected parent folder \n  * fixed: New/unread messages in collapsed thread were not\n    obvious enough \n  * fixed: Pressing Delete on Trash folder could remove it\n    without confirmation \n  * fixed: Renaming of a 'unified folder' created a duplicate\n  * fixed: Clicking on a folder in the folder pane did not always\n    open folder \n  * fixed: Messages nested deeper than 255 levels disappeared\n    from threading view \n  * fixed: Performing Delete followed by Undo on thread parent\n    message could corrupt view \n  * fixed: Single messages still appeared collapsible after\n    thread members were deleted \n  * fixed: Updated threads remained misordered until folder\n    refresh or resort \n  * fixed: Global search failed to display inaccessible messages\n    found in local folders \n  * fixed: Numeric subfolders were sorted alphabetically instead\n    of naturally \n  * fixed: Virtual folder folder-picker showed unlabeled IM\n    account as selectable folder \n  * fixed: Some folders showed new mail count prior to receiving\n    mail \n  * fixed: Menu Bar -\u003e View contained duplicate accelerator keys\n  * fixed: Unified toolbar Spam button did not switch to 'Not\n    Spam' when spam message selected \n  * fixed: Warning was not logged if\n    `mail.openpgp.alias_rules_file` file did not exist\n  * fixed: Not all headers were signed when creating digitally\n    signed OpenPGP email \n  * fixed: When configuring external GnuPG, user was not promted\n    to import public key \n  * fixed: 'Open and Show' for OpenPGP-signed message (.eml) did\n    not work \n  * fixed: Invalidly signed unencrypted emails were indicated as\n    worse than unsigned ones \n  * fixed: Reason for revoked certificate was not shown\n  * fixed: Apple Mail OpenPGP emails failed to decrypt due to\n    hidden recipient key ID \n  * fixed: OpenPGP import of public key with experimental packets\n    failed with unclear error \n  * fixed: Opening messages with OpenPGP keys was slow and\n    blocked the UI for large keyrings \n  * fixed: OpenPGP key refresh failed when fingerprint lookup\n    returned multiple results \n  * fixed: Encrypted Gmail CSE emails with outer opaque S/MIME\n    were not readable \n  * fixed: Invalid S/MIME encryption certificate caused\n    misleading send errors \n  * fixed: 'Search Messages' search did not finish due to\n    unparsable local folders \n  * fixed: Search results showed older irrelevant emails before\n    newer exact matches \n  * fixed: Filter search on Body missed draft messages containing\n    German umlauts \n  * fixed: Esc cleared quick filter pin after changing folder\n  * fixed: Thunderbird could crash during local message search\n  * fixed: Replying could fail with\n    `mailnews.reply_quoting_selection.multi_word` set false\n  * fixed: Drag-drop of unselected contact inserted wrong or no\n    email address \n  * fixed: Changing identity in compose window caused modified\n    draft not to be saved \n  * fixed: Shift-click 'Compose Message To' on 'mailto' link did\n    not open in plain text \n  * fixed: Reply with selected text lost formatting for HTML\n    messages containing \u0026lt;/pre\u0026gt; \n  * fixed: Multipart/related attachments were not preserved when\n    editing or forwarding \n  * fixed: Forwarded malformed MIME email had empty body and\n    extra attachment \n  * fixed: Message compose window was removed from Task Bar after\n    saving as draft or template \n  * fixed: Dragging email address between compose windows failed\n    to add recipients \n  * fixed: Thunderbird could crash when using Find and Replace\n    All \n  * fixed: Compose with PDF attachments opened PDFs instead of\n    creating a new email \n  * fixed: Multiple saves while using 'Options' -\u003e 'Send a Copy'\n    resulted in multiple copies \n  * fixed: Search for 'Attachment' in Settings menu did not find\n    'Files and Attachments' \n  * fixed: Add-on account creation did not work with Account Hub\n  * fixed: Owl install did not show link to website in Account\n    Hub \n  * fixed: Username field did not appear in Account Hub when\n    exchange authentication failed \n  * fixed: Account Hub advanced config setup did not include\n    default outgoing config \n  * fixed: Disabled inputs could be toggled in Account Hub\n    address book \n  * fixed: Users could not disable spinning overlay in Account\n    Hub for email \n  * fixed: Account Hub local address book creation could continue\n    with blank name \n  * fixed: Account Hub email success messages were not always\n    accurate about config source \n  * fixed: Calendar/address book sections were shown in Account\n    Hub when there were none \n  * fixed: New password-based Exchange accounts failed to save\n    passwords in login manager \n  * fixed: Account hub showed connection security instead of\n    actual authentication method \n  * fixed: New identity dialog lacked reply-matching and end-to-\n    end encryption settings \n  * fixed: Thunderbird could fail to shut down cleanly during\n    active OAuth requests \n  * fixed: Account Hub kept OAuth selected after changing to\n    hostname without OAuth support \n  * fixed: Account Hub autodetect wrongly prompted for a password\n    when auth was unavailable \n  * fixed: Interrupted external OAuth2 setup required restarting\n    Thunderbird \n  * fixed: The default account could be reset after restart if\n    uninitialized \n  * fixed: Virtual folders did not update correctly for filtered\n    POP3 messages \n  * fixed: 'Copy Message to' action in a newsgroup filter did not\n    work \n  * fixed: Thunderbird could crash while importing mail thread\n  * fixed: Thunderbird did not clearly fail when importing\n    profile from a bad source \n  * fixed: Thunderbird could not import profile located at the\n    top level of zip file \n  * fixed: 'Any Number' was unavailable in address book search\n    with 'Match all of the following' \n  * fixed: Contact not found in Advanced Address Book Search if\n    phone number had a period \n  * fixed: Thunderbird did not display contact photos in WebP\n    format from CardDAV servers \n  * fixed: Opening a vCard (.vcf) from file manager or CLI did\n    not work in some cases \n  * fixed: Redirected CardDAV URLs resolved relative URLs against\n    the wrong host \n  * fixed: Installations from Microsoft Store did not open when\n    clicking 'mailto:' links \n  * fixed: Windows new message notification click did not bring\n    Thunderbird to foreground \n  * fixed: Microsoft Store installs did not open when clicking\n    'news://' link or .eml file \n  * fixed: Using thunderbird -compose with double quotes made\n    last email address invalid \n  * fixed: Clicking the backspace icon in the quick filter field\n    cleared the input field \n  * fixed: Subfolder kept stale accessibility unread count after\n    unread messages were deleted \n  * fixed: Moving virtual folder within maildir based IMAP or\n    local folder could fail \n  * fixed: Thunderbird could crash when completing folder\n    copy/move \n  * fixed: 'Edit as New Message' and inline 'Forward' not\n    possible with PGP-signed messages \n  * fixed: Various MIME improvements \n  * fixed: Forwarding some Apple Mail messages incorrectly\n    attached inline text as a file \n  * fixed: Thunderbird could crash when marking all messages as\n    read \n  * fixed: Auto-compaction could corrupt database and cause\n    crashes during syncs \n  * fixed: 'news:' URIs without specific server had incorrect\n    format displayed in status bar \n  * fixed: 'Mark' -\u003e 'All Read' affected newsgroup messages that\n    had not been fetched yet \n  * fixed: Thunderbird could not reconnect to newsgroups after\n    connection loss until restarted \n  * fixed: Sending a newsgroup post appeared successful when it\n    had actually failed \n  * fixed: Saving a new draft retained superceded version\n  * fixed: Thunderbird hung when auto-checking multiple accounts\n    for new messages \n  * fixed: Spam not checked with\n    `mail.server.default.check_all_folders_for_new` on\n  * fixed: Startup could be slow with large number of folders not\n    using subscriptions \n  * fixed: Saved search in unified folder resulted in server\n    error \n  * fixed: Thunderbird did not report refused POP3 connection\n  * fixed: Remove message body retention policy was not\n    functional \n  * fixed: POP3 could stop downloading mail until restart\n  * fixed: With auto-mark-read disabled, large mail still marked\n    as read during load delay \n  * fixed: IMAP 'Show only subscribed folders' could not be\n    changed without restart \n  * fixed: POP3 deadlocked when server went silent without\n    closing socket \n  * fixed: Thunderbird could crash when mail folder was renamed\n    or moved \n  * fixed: NNTP server with invalid TLS certificate could not be\n    added to certificate exceptions \n  * fixed: Cancelled message send could not be retried and hung\n    with SMTP timeout errors \n  * fixed: Corrupted NNTP account data caused excessive memory\n    use and startup crash \n  * fixed: Multiple selected IMAP folders could not be moved or\n    deleted together \n  * fixed: Non-Latin IMAP keywords were lowercased and encoded\n    incorrectly as MUTF-7 \n  * fixed: Message tags were lost when moving folder from local\n    folder to IMAP folder \n  * fixed: Removing a chat account threw an exception and failed\n    to clear the UI \n  * fixed: Enterprise policy use not indicated in\n    about:preferences with link to about:policies \n  * fixed: Language field in settings was empty after restart in\n    Troubleshoot Mode \n  * fixed: Primary Password policy was detected but not enforced\n    for saved account passwords \n  * fixed: Archived RSS feed messages were sent to the archive\n    folder of default identity \n  * fixed: Broken feed icon could prevent updating of feeds\n  * fixed: Task reminders could fail for tasks without end dates\n    or with shifted due dates \n  * fixed: Calendar did not alert user for connection issues\n  * fixed: Copying one recurring event occurrence failed to set\n    the date when pasted \n  * fixed: Could not copy an event in multiweek or month view by\n    drag-and-drop \n  * fixed: Duplicate attendees were added to invitations instead\n    of being filtered out \n  * fixed: Calendar discovery with certificate error displayed\n    multiple exceptions \n  * fixed: It was not possible to create date-only all-day tasks\n  * fixed: Task percentage complete was not preserved separately\n    from status in tooltips \n  * fixed: Calendar invites were incorrectly marked processed\n    after calendar sync completed \n  * fixed: ICS event comments were not displayed in Thunderbird\n    event details \n  * fixed: Dismissed Gmail calendar reminder did nothing and item\n    stayed visible \n  * fixed: iCal imports misread unknown timezones as GMT,\n    creating events at wrong times \n  * fixed: Could not export local calendar as HTML \n  * fixed: Cancelled filter edit dialog closed the message filter\n    dialog \n  * fixed: Visual and UX improvements \n  * CVE-2026-14899 \n    Off-by-one out of bounds read in MIME header parser for\n    forwarding\n  * CVE-2026-16349 \n    Same-origin policy bypass in the DOM: Navigation component\n  * CVE-2026-16350 \n    Incorrect boundary conditions in the Audio/Video: cubeb\n    component\n  * CVE-2026-16362 \n    Use-after-free in the WebRTC: Audio/Video component\n  * CVE-2026-16351 \n    Sandbox escape due to use-after-free in the DOM: Navigation\n    component\n  * CVE-2026-16352 \n    Sandbox escape due to use-after-free in the Disability Access\n    APIs component\n  * CVE-2026-16363 \n    JIT miscompilation in the JavaScript: WebAssembly component\n  * CVE-2026-16364 \n    Incorrect boundary conditions in the Audio/Video: Playback\n    component\n  * CVE-2026-16365 \n    Privilege escalation in the DOM: Workers component\n  * CVE-2026-16366 \n    Privilege escalation in the DOM: Navigation component\n  * CVE-2026-16353 \n    Invalid pointer in the DOM: Bindings (WebIDL) component\n  * CVE-2026-16354 \n    Information disclosure in the Graphics: ImageLib component\n  * CVE-2026-16367 \n    Sandbox escape due to invalid pointer in the Disability\n    Access APIs component\n  * CVE-2026-16368 \n    Incorrect boundary conditions in the JavaScript: WebAssembly\n    component\n  * CVE-2026-16369 \n    Integer overflow in the JavaScript: WebAssembly component\n  * CVE-2026-16355 \n    JIT miscompilation in the JavaScript Engine: JIT component\n  * CVE-2026-16356 \n    Sandbox escape due to use-after-free in the Disability Access\n    APIs component\n  * CVE-2026-16357 \n    Incorrect boundary conditions in the Graphics component\n  * CVE-2026-16370 \n    Mitigation bypass in the DOM: Networking component\n  * CVE-2026-16371 \n    Privilege escalation in the DOM: Navigation component\n  * CVE-2026-16372 \n    Privilege escalation in the DOM: Content Processes component\n  * CVE-2026-16374 \n    Information disclosure in the Framework component in DevTools\n  * CVE-2026-16375 \n    Site isolation issue in the Networking: HTTP component\n  * CVE-2026-16376 \n    Denial-of-service in the Graphics: WebGPU component\n  * CVE-2026-16377 \n    Mitigation bypass in the PDF Viewer component\n  * CVE-2026-16378 \n    Other issue in the DOM: Copy \u0026 Paste and Drag \u0026 Drop\n    component\n  * CVE-2026-16379 \n    Privilege escalation in the DOM: Content Processes component\n  * CVE-2026-16358 \n    Site isolation issue in the Graphics: WebRender component\n  * CVE-2026-16380 \n    Mitigation bypass in the Networking component\n  * CVE-2026-16381 \n    Same-origin policy bypass in the Networking: DNS component\n  * CVE-2026-16382 \n    Mitigation bypass in the DOM: Service Workers component\n  * CVE-2026-16383 \n    Mitigation bypass in the DOM: Networking component\n  * CVE-2026-16384 \n    Information disclosure due to uninitialized memory in the\n    Graphics: WebGPU component\n  * CVE-2026-16385 \n    Information disclosure due to uninitialized memory in the\n    Graphics: WebGPU component\n  * CVE-2026-16386 \n    Information disclosure due to uninitialized memory in the\n    Graphics: WebGPU component\n  * CVE-2026-16387 \n    Site isolation issue in the Networking component\n  * CVE-2026-16388 \n    Sandbox escape in the DOM: Networking component\n  * CVE-2026-16389 \n    Incorrect boundary conditions, integer overflow in the\n    Libraries component in NSS\n  * CVE-2026-16390 \n    Mitigation bypass in the Enterprise Policies component\n  * CVE-2026-16391 \n    Information disclosure in the Storage: IndexedDB component\n  * CVE-2026-16392 \n    JIT miscompilation in the JavaScript Engine: JIT component\n  * CVE-2026-16393 \n    Incorrect boundary conditions in the Graphics: WebGPU\n    component\n  * CVE-2026-16359 \n    Incorrect boundary conditions in the Audio/Video: GMP\n    component\n  * CVE-2026-16394 \n    Mitigation bypass in the DOM: Security component\n  * CVE-2026-16395 \n    Integer overflow in the Audio/Video component\n  * CVE-2026-16396 \n    Privilege escalation in WebExtensions\n  * CVE-2026-16398 \n    Site isolation issue in the Graphics component\n  * CVE-2026-16399 \n    Site isolation issue in the DOM: Navigation component\n  * CVE-2026-16400 \n    Information disclosure in the DOM: Security component\n  * CVE-2026-16401 \n    Privilege escalation in the Data Loss Prevention component\n  * CVE-2026-16402 \n    Integer overflow in the Graphics: ImageLib component\n  * CVE-2026-16403 \n    Spoofing issue in the Address Bar component\n  * CVE-2026-16405 \n    Information disclosure in the Networking: WebSockets\n    component\n  * CVE-2026-16406 \n    Mitigation bypass in the Networking component\n  * CVE-2026-16407 \n    Mitigation bypass in the DOM: Service Workers component\n  * CVE-2026-16408 \n    Integer overflow in the Audio/Video: Playback component\n  * CVE-2026-16409 \n    Invalid pointer in the Security: PSM component\n  * CVE-2026-16410 \n    JIT miscompilation in the JavaScript Engine: JIT component\n  * CVE-2026-16411 \n    Memory safety bugs fixed in Thunderbird 153\n  * CVE-2026-16412 \n    Memory safety bugs fixed in Thunderbird ESR 140.13 and\n    Thunderbird 153\n  * CVE-2026-16360 \n    Memory safety bugs fixed in Thunderbird ESR 140.13 and\n    Thunderbird 153\n","status":"published","published":"2026-09-18T14:51:02Z","modified":"2026-09-19T09:00:04.375866356Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}