Nixpkgs security tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-84641
created 1 week, 6 days ago Activity log
  • Created suggestion 1 week, 6 days ago
Information disclosure due to malicious IMAP server response

A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.

Affected products

Thunderbird
  • =<140.*
  • =<153.*
  • =<*

Matching in nixpkgs

pkgs.thunderbird-cli

Low-level CLI to manage Mozilla Thunderbird email from the shell

pkgs.thunderbird-mcp

MCP server for Thunderbird - enables AI assistants to access email, contacts, and calendars

pkgs.thunderbird-cli-bridge

HTTP/WebSocket bridge daemon between thunderbird-cli (or any HTTP client) and the Thunderbird-cli WebExtension. Stateless proxy, localhost-only.

Package maintainers