CVE-2026-84637: 
NixOS vulnerability analysis and mitigation

CVE-2026-84637 is a vulnerability in Mozilla Thunderbird that allows malicious calendar invitations to use file:// URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. When the new invitation display is enabled, the attachment can also appear under a misleading filename, facilitating social engineering. The vulnerability was discovered by researcher Trung Nguyen and disclosed on September 1, 2026. It affects all Thunderbird versions prior to 153.2.0 and versions 154.0 up to (but not including) 155.0. The CVSS v3.1 base score is 9.8 (Critical) per Feedly/NVD aggregation, though Mozilla's own advisories rate the impact as "low" in context (Mozilla Advisory MFSA2026-78, Mozilla Advisory MFSA2026-88, Red Hat CVE).

The root cause is classified under CWE-59 (Improper Link Resolution Before File Access / 'Link Following') and CWE-434 (Unrestricted Upload of File with Dangerous Type). Thunderbird's calendar invitation handler fails to properly validate or restrict file:// URI schemes used as attachment references, allowing them to resolve and execute local or UNC-path-hosted executables on Windows rather than treating them as blocked dangerous file types. When the new invitation display UI is active, the attachment can be rendered with an arbitrary, misleading filename, increasing the likelihood of user interaction. The attack is network-delivered via a crafted calendar invitation (e.g., an .ics file) sent to a target Thunderbird user (Mozilla Advisory MFSA2026-78, Mozilla Advisory MFSA2026-88, Red Hat Bugzilla).

Successful exploitation allows an attacker to execute arbitrary local or network-hosted executables on a Windows system running a vulnerable version of Thunderbird, with the privileges of the Thunderbird process (typically the logged-in user). This can lead to full compromise of confidentiality, integrity, and availability of the affected system, including credential theft, malware installation, ransomware deployment, or lateral movement within a network. The misleading filename feature further increases the risk by reducing the likelihood that a user will recognize the malicious nature of the attachment (Mozilla Advisory MFSA2026-78, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The NVD SSVC assessment notes the vulnerability is "automatable" with "total" technical impact, but exploitation status is listed as "none." The EPSS score is approximately 0.0015 (0.15%), indicating a low current probability of exploitation in the wild. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE (Mozilla Advisory MFSA2026-88).

1. Craft a malicious calendar invitation: Create a .ics (iCalendar) file containing an attachment reference using a file:// URI pointing to a local executable (e.g., file:///C:/Windows/System32/calc.exe or a UNC path like file://attacker-server/share/malware.exe) or a network-hosted executable.
2. Apply filename spoofing (optional): If the target has the new invitation display enabled, set the attachment's displayed filename to something benign (e.g., meeting_agenda.pdf) to disguise the malicious executable.
3. Deliver the invitation: Send the crafted .ics file to the target via email or calendar sharing to a Thunderbird user running a vulnerable version (prior to 153.2 or 154.0–154.x before 155.0) on Windows.
4. Trigger execution: When the victim opens or previews the calendar invitation in Thunderbird and interacts with the attachment (e.g., clicks it), Thunderbird resolves the file:// URI and launches the referenced executable, bypassing normal attachment protection controls.
5. Achieve objective: The launched executable runs with the victim's user privileges, enabling the attacker to establish persistence, exfiltrate data, or deploy additional payloads (Mozilla Advisory MFSA2026-78, Mozilla Advisory MFSA2026-88).

• Network: Outbound SMB (port 445) or WebDAV connections from the Thunderbird process (thunderbird.exe) to external or unexpected UNC/network hosts; DNS queries for attacker-controlled hostnames originating from the Thunderbird process.
• Process: Unexpected child processes spawned by thunderbird.exe (e.g., cmd.exe, powershell.exe, mshta.exe, or other executables not normally launched by Thunderbird); execution of binaries from unusual paths (e.g., temp directories, network shares).
• File System: Presence of unexpected .ics files in the Thunderbird profile or temp directories containing file:// URIs referencing executables; newly created or modified executables in user-writable directories shortly after opening a calendar invitation.
• Logs: Windows Event Logs (Security/System) showing process creation events (Event ID 4688) with thunderbird.exe as the parent process for unexpected child executables; Thunderbird activity logs referencing file:// URI resolution for calendar attachments.

Mozilla has released patches addressing this vulnerability in Thunderbird 153.2 (ESR branch) and Thunderbird 154 (standard release). Users should upgrade to one of these versions or later immediately (Mozilla Advisory MFSA2026-78, Mozilla Advisory MFSA2026-88). As a precautionary measure prior to patching, users should exercise caution when opening calendar invitations from untrusted or unknown senders and avoid clicking on attachments within invitations that appear suspicious or use unexpected filenames. Disabling the new invitation display UI (if configurable) may reduce the filename-spoofing attack surface but does not fully mitigate the underlying file:// URI execution issue.

Mozilla rated the impact of CVE-2026-84637 as "low" in both the Thunderbird 154 and Thunderbird 153.2 advisories, noting that scripting is generally disabled when reading mail in Thunderbird, limiting the broader attack surface (Mozilla Advisory MFSA2026-78, Mozilla Advisory MFSA2026-88). Red Hat and other downstream vendors tracked the issue as high severity in their bug tracking systems, reflecting the potential for arbitrary code execution (Red Hat Bugzilla). Security aggregators such as BeyondMachines noted the vulnerability as part of a broader batch of 38 vulnerabilities patched in Mozilla's August/September 2026 Thunderbird and Firefox updates.