CVE-2026-84641

A vulnerability exists in unspecified versions of Thunderbird, where a malicious IMAP server can exploit a crafted ID response to trigger a use-after-free condition and disclose heap memory contents, potentially leading to sensitive information being written to prefs.js. Organizations using affected versions of Thunderbird should prioritize updating to versions 155, 140.15, or 153.2 to mitigate the risk of information exposure. This issue is particularly relevant for environments that rely on email communications and may be targeted by attackers leveraging IMAP.