CVE-2026-84637

A flaw was found in Thunderbird. Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows systems. This bypasses Thunderbird's built-in protections for executable attachments, potentially leading to arbitrary code execution. Additionally, the attachment could be disguised with a misleading filename, increasing the risk of exploitation.

This Important flaw in Thunderbird allows arbitrary code execution when processing malicious calendar invitation attachments. While the vulnerability description highlights a Windows-specific exploitation vector, the underlying issue could still affect Red Hat systems running Thunderbird, potentially leading to system compromise through user interaction with crafted invitations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.