CVE-2026-84641: 
NixOS Analisi e mitigazione delle vulnerabilità

CVE-2026-84641 is an information disclosure vulnerability in Mozilla Thunderbird titled "Information disclosure due to malicious IMAP server response." A malicious IMAP server can trigger a use-after-free and heap-memory disclosure by sending a crafted IMAP ID response; the exposed heap contents can ultimately be persisted to the user's prefs.js file. The vulnerability affects Thunderbird versions prior to 155, prior to 140.15 (ESR), and prior to 153.2 (ESR). It was discovered by researcher ABDULAZIZ ALASAIQAH, disclosed and patched on September 1, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (Mozilla MFSA 2026-86, Mozilla MFSA 2026-87, Mozilla MFSA 2026-88).

The root cause is a use-after-free (CWE-416) combined with an expired pointer dereference (CWE-825) in Thunderbird's IMAP client code when processing the server's ID command response. When a maliciously crafted IMAP ID response is received, Thunderbird accesses already-freed heap memory, leaking its contents. The leaked heap data can then be written to the user's prefs.js preferences file, potentially exposing sensitive in-memory data to an attacker who controls or can observe that file. Exploitation requires no user interaction and no privileges — only that the victim's Thunderbird client connects to a malicious or compromised IMAP server (Mozilla MFSA 2026-86, Red Hat Bugzilla).

Successful exploitation results in a high-confidentiality impact: sensitive heap memory contents from the Thunderbird process are disclosed and can be persisted to prefs.js on disk, potentially exposing credentials, session tokens, or other sensitive data stored in memory. There is no direct integrity or availability impact. The vulnerability is rated "low" impact by Mozilla in the context of Thunderbird's email reading mode (where scripting is disabled), but poses a meaningful risk when users connect to untrusted or attacker-controlled IMAP servers (Mozilla MFSA 2026-86, Mozilla MFSA 2026-87).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-84641. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The NVD assessment notes the vulnerability is automatable (no user interaction required) but exploitation has not been observed. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Mozilla MFSA 2026-86, Red Hat Bugzilla).

1. Set up a malicious IMAP server: The attacker configures or compromises an IMAP server to respond with a specially crafted IMAP ID response that triggers the use-after-free condition in Thunderbird's IMAP client.
2. Lure the victim to connect: The attacker directs a Thunderbird user to configure an email account pointing to the malicious IMAP server (e.g., via phishing, DNS hijacking, or a rogue Wi-Fi access point performing a man-in-the-middle attack).
3. Trigger the vulnerability: When Thunderbird connects and the IMAP server sends the crafted ID response, Thunderbird's IMAP handling code accesses freed heap memory, causing a use-after-free that leaks heap contents.
4. Harvest disclosed data: The leaked heap memory contents are written to the victim's prefs.js file on disk. The attacker then reads prefs.js (if they have local access) or exfiltrates it through another vector to extract sensitive data such as credentials or session tokens (Mozilla MFSA 2026-86, Red Hat Bugzilla).

• File System: Unexpected or anomalous content in the Thunderbird profile's prefs.js file — particularly binary-looking or garbled data that does not correspond to valid preference values; sudden increase in prefs.js file size.
• Network: Thunderbird client connections to unknown or untrusted IMAP servers (port 143/993); IMAP sessions where the server sends an unusual or oversized ID response (* ID (...) command).
• Logs: Thunderbird crash reports or error logs referencing memory access violations or use-after-free conditions in IMAP-related components; unexpected Thunderbird process crashes shortly after IMAP connection establishment.

Mozilla has released patched versions addressing CVE-2026-84641: Thunderbird 155, Thunderbird ESR 140.15, and Thunderbird ESR 153.2. Users should update to one of these versions immediately. As a workaround, users can avoid connecting Thunderbird to untrusted or unknown IMAP servers until the patch is applied. No configuration-based workaround within Thunderbird has been documented by Mozilla (Mozilla MFSA 2026-86, Mozilla MFSA 2026-87, Mozilla MFSA 2026-88).

Mozilla rated this vulnerability as "low" impact in the context of Thunderbird's email reading mode, noting that scripting is disabled when reading mail. Red Hat tracked the issue as low severity in their Bugzilla system. The vulnerability was part of a broader September 1, 2026 Thunderbird security release that addressed 38 vulnerabilities across Firefox and Thunderbird, which received coverage from Linux security news outlets (Mozilla MFSA 2026-86, Red Hat Bugzilla).