CVE-2026-84637 Calendar invitation attachments could launch local executables

Critical 9.8 Published 1 Sep 2026 Updated 2 Sep 2026

Attackers can execute local or network binaries via malicious calendar attachments in Thunderbird when the new invitation display is enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-84637?

CVE-2026-84637 is a critical vulnerability in Mozilla Thunderbird, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

Weakness: CWE-434

Which versions are affected by CVE-2026-84637?

It affects 1 product.

Products include Mozilla Thunderbird.

How do I fix CVE-2026-84637?

Upgrade to a fixed version.

Is CVE-2026-84637 being exploited?

There is no known exploitation of CVE-2026-84637 in the wild and no public exploit code.

All Mozilla Thunderbird vulnerabilities

Sources

Also known as GHSA-3q74-4f83-x4rj, UBUNTU-CVE-2026-84637.