{"id":"CVE-2026-84639","title":"thunderbird: Uninitialized memory in MIME parsing (CVE-2026-84639)","summary":"A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:\nTriggering an error condition in certain MIME bodies would cause uninitialized\nmemory to be used.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvssSource":"vendor","cwe":"CWE-824","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 9)","affected":["enterprise_linux 10","enterprise_linux 6","enterprise_linux 7","enterprise_linux 8","enterprise_linux_appstream_v_9"],"patched":["enterprise_linux_appstream_v_9"],"published":"2026-09-01","updated":"2026-09-24","sourceUpdated":"2026-09-24T03:29:10+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84639.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84639.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-84639"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527113"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-84639"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84639"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-84639"},{"url":"https://access.redhat.com/errata/RHSA-2026:70642"},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2061087"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-86/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-87/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-88/"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00323,"epssPercentile":0.25559,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-02T18:48:36.137068Z"},"scores":{"vendor":7.5,"adp":9.1},"ingestedAt":"2026-09-17T19:26:25.326Z","slug":"CVE-2026-84639","body":"## Overview\n\nA flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:\nTriggering an error condition in certain MIME bodies would cause uninitialized\nmemory to be used.\n\n## Vendor advisories\n\n- **RHSA-2026:70642** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:70642)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-84639.json)\n\n**thunderbird: Uninitialized memory in MIME parsing** — rated Important by Red Hat. Released 2026-09-01, updated 2026-09-24.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 9)\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:70642","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":209987,"id":"CVE-2026-84639","ts":1790235629403,"field":"cvss","old":"9.1","new":"7.5"},{"seq":209986,"id":"CVE-2026-84639","ts":1790235629403,"field":"severity","old":"critical","new":"high"}]}