CVE-2026-84637 in Thunderbird
Summary
by MITRE • 09/02/2026
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The identified vulnerability represents a significant security flaw within Mozilla Thunderbird's handling of calendar invitations that utilize file URI attachments to execute arbitrary code on the host system. By exploiting this weakness, an attacker can bypass the application’s standard protections against executable attachment execution. The core technical issue lies in how Thunderbird processes specific types of embedded resources within iCalendar format messages. When a malicious actor crafts a calendar invitation containing a file URI that points to either a local or network-hosted executable, the client may interpret this resource as safe for interaction under certain conditions. This behavior contradicts the expected security model where attachments are typically sandboxed or blocked if they pose an execution risk. The flaw effectively allows remote code execution without user consent beyond opening the invitation, depending on how the new invitation display feature is configured and triggered.
This vulnerability specifically impacts systems running Microsoft Windows due to its native support for file URIs that can directly invoke local applications via shell commands. In a typical scenario, an attacker would distribute a malicious calendar invite through email or other messaging channels supported by Thunderbird. Upon viewing the message with the new invitation display enabled, the attachment might appear under a misleading filename designed to mimic legitimate files such as documents or images. This social engineering aspect increases the likelihood of user interaction. If the system processes the file URI correctly without proper validation or sandboxing restrictions, it can launch the specified executable located on the local disk or accessed via a network share. The ability to reference network-hosted executables expands the attack surface significantly, allowing for drive-by download scenarios where the payload is fetched from an external server controlled by the attacker rather than stored locally beforehand.
The operational impact of this vulnerability is severe as it compromises the integrity and confidentiality of the user's system. Successful exploitation leads to arbitrary code execution with the privileges of the current user account. This can result in data theft, installation of additional malware such as ransomware or keyloggers, or use of the compromised machine as part of a botnet. The bypassing of executable attachment protections means that traditional email security filters relying on file extension checks may fail to detect this threat vector because the payload is not delivered as a standard attached file but rather through a URI reference within a calendar event structure. This makes detection more challenging for both end-users and automated security tools unless they specifically monitor for suspicious iCalendar content or unusual network connections initiated by Thunderbird processes.
Mitigation strategies primarily involve applying the software updates released to address this issue immediately. Users should upgrade to Thunderbird version 154 or later, including patch level 153.2, which contain the necessary code changes to validate and sanitize file URI attachments within calendar invitations. Until patches are applied, administrators can enforce security policies that restrict the execution of scripts or applications from temporary directories where such payloads might be cached. Additionally, disabling the new invitation display feature if available in older versions may reduce exposure by preventing the rendering logic that triggers the vulnerability. Organizations should also implement email filtering solutions capable of inspecting MIME parts for malicious iCalendar content and blocking messages containing suspicious file URIs. Regular security awareness training is recommended to help users recognize potentially deceptive calendar invites, particularly those with misleading filenames or unexpected attachments.