CVE-2026-84642

The vulnerability arises from the improper handling of the `mail.allowed_attachment_hostnames` configuration setting in certain versions of Thunderbird, where unescaped values in a regular expression could allow unintended hostnames to match and serve remote attachments. This flaw poses a risk of unauthorized access to potentially malicious attachments, impacting users who rely on secure email practices. Organizations using affected versions of Thunderbird should prioritize updating to versions 155 or 153.2 to mitigate this risk.