Vulnerability · Published Sep 1, 2026 · Assigned by mozilla
CVE-2026-84642Allowed UNC hostnames for attachments interpreted as a regular expression
High 7.5
In plain English
A high-severity regular-expression denial of service in Thunderbird from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 63.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-84642 |
| Ubuntu:24.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-84642 |
| Ubuntu:26.04:LTS | thunderbird | no fix listed | UBUNTU-CVE-2026-84642 |
| Ubuntu:26.10 | thunderbird | no fix listed | UBUNTU-CVE-2026-84642 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Thunderbird | see references |
Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N