CVE-2026-84642

CVE-2026-84642 affects Mozilla Thunderbird , where the mail.allowed_attachment_hostnames advanced config setting values were inserted into a regular expression without escaping . For certain valid hostnames, this regex injection allowed unintended hostnames to match , enabling remote attachments ...

CVE-2026-84642 Allowed UNC hostnames for attachments interpreted as a regular expression

The values of the mail.allowedattachmenthostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 15...