External risk intelligence

Thunderbird Calendar Invitations Execute Local Files Via File URI Attachments.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-84637

This vulnerability affects a desktop email client application (Thunderbird) and requires the user to interact with a malicious calendar invitation. It is a client-side application vulnerability rather than a public-facing network service, edge gateway, or internet-accessible API endpoint.

Unrestricted File Upload

Mozilla Thunderbird

before 153.2.0154.0 to before 155.0

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Thunderbird email client that could allow malicious calendar invitations to launch executables on Windows systems. The issue arises from how file URI attachments are handled within calendar invitations, potentially bypassing security checks and executing unintended programs under misleading filenames.

Malicious invites may run programs on Windows.
A user interaction flaw allows code execution.
Confirm if Thunderbird is used and invitations are processed.

Attack Path

How an attacker could exploit the issue

An attacker can send a specially crafted calendar invitation containing a file URI attachment. When this invitation is opened in Thunderbird with the new invitation display enabled, the attachment, appearing under a deceptive filename, can be used to launch local or network-hosted executables on Windows. This bypasses Thunderbird's usual security measures for executable attachments.

No special access or authentication needed.
Malicious calendar invitation with file URI.
Arbitrary code execution on user's machine.

Live Threat

Current exploitation, exposure, and threat context

Malicious calendar invitations, when processed by Thunderbird with specific display features enabled, could trick users into launching executables disguised as ordinary attachments. This could occur when the new invitation display is enabled, allowing attachments to be presented with misleading filenames. The vulnerability could allow for the execution of local or network-hosted programs on Windows systems.

Local executables or network programs.
User opens a disguised calendar invitation.
Unauthorized code execution on Windows.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects desktop email clients and requires user interaction, making it a client-side application issue rather than a direct network service threat. Initial triage should focus on identifying all instances of the affected application, assessing their business criticality, and confirming ownership. Subsequently, remediation efforts, potentially involving vendor coordination or temporary risk reduction, should be planned and executed based on the identified risk posture.

Own the issue: Application owners and security teams.
Verify first: Affected application presence and reachability.
Action: Plan remediation based on business risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Thunderbird?

Thunderbird is a cross-platform, open-source email client used to manage electronic communications, calendars, and tasks. It handles various data formats, including calendar invitations, which integrate into its scheduling feature to allow users to organize meetings and appointments directly within the application's interface.

What does CWE-434 mean for CVE-2026-84637?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In this context, it means the application fails to properly validate or restrict files attached to calendar invitations. Because these files are handled incorrectly, the software inadvertently allows potentially harmful executables to bypass standard security protections that would normally block or flag them, enabling them to run on the Windows operating system.

How is this vulnerability triggered?

The issue is triggered when a user opens a specially crafted calendar invitation that contains a file URI attachment while the new invitation display feature is active. The bug does not trigger if the invitation remains unopened, nor does it affect Thunderbird installations where the new invitation display feature is disabled. It requires the processing of the malicious attachment for the code to execute.

Is this vulnerability an internet-facing threat?

No. According to Halo Surface Signal, this is a client-side application vulnerability rather than a public-facing service. Because Thunderbird is a desktop client, it does not act as an internet-accessible gateway or API. The risk is limited to the specific Windows workstations where the application is installed and used to process calendar invites, rather than being a direct network-wide exposure.

Do I need to update my software to fix this?

Yes. To resolve the vulnerability, you must update your installation to Thunderbird 154 or 153.2 or later. These versions contain the necessary patches to correct how file URI attachments are handled within calendar invitations. Your first step should be to locate all instances of the application in your environment to ensure they are updated to these secure versions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.