Description

Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-01T22:17:19.597Z",
  "pubdate": "2026-09-01T22:17:19.597Z",
  "executiveSummary": "This vulnerability involves an improper validation flaw within Thunderbird's calendar invitation processing mechanism. The issue allows malicious actors to embed file URI attachments within calendar invites that, when rendered by the client, can force the execution of arbitrary local or network-hosted binaries on the underlying Windows operating system. By bypassing the application's native security controls designed to restrict executable attachments, an attacker can achieve remote code execution (RCE) in the context of the user. The vulnerability is further exacerbated by the invitation display implementation, which can render the attachment with a misleading filename, increasing the likelihood of user interaction. Affected products include Thunderbird versions prior to 153.2 and 154. Successful exploitation requires the victim to open a maliciously crafted calendar invitation, potentially leading to full system compromise, unauthorized data access, or the deployment of persistent malware.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization and handling of URI schemes within Thunderbird’s calendar invitation processing module. While Thunderbird maintains security policies to prevent the direct execution of dangerous file types sent as standard email attachments, the calendar subsystem fails to apply these same restrictions to file URI-based attachments.\nWhen a calendar invitation is processed, the application parses the invitation data. If an attacker specifies a file URI (e.g., file:// or network paths like \\\\attacker-server\\share\\malware.exe) as an attachment, the application may interpret this URI as a legitimate resource to be executed rather than a passive file to be opened. On Windows systems, the operating system's shell execution mechanisms, such as ShellExecute, are invoked by the application to handle these URIs, effectively bypassing the internal Thunderbird security layers that would otherwise flag or block executable extensions.\nThe attack flow proceeds as follows: 1) The attacker constructs a malicious calendar invitation containing a specially crafted attachment reference using a file URI. 2) The attacker leverages the vulnerability in the calendar invitation display component to obfuscate the true nature of the file, presenting a misleading filename to the user. 3) The target user receives and views the invitation. 4) Upon interacting with the invitation or allowing the automated rendering process, the application triggers the system to resolve the URI. 5) The Windows OS interprets the URI and executes the binary pointed to by the file path, either from the local filesystem or a remote network share, inheriting the privileges of the Thunderbird process.\nThis vulnerability is particularly dangerous as it circumvents standard attachment security logic, allowing attackers to execute arbitrary code without traditional email attachment filtering. The exploit does not require authentication from the victim other than the act of opening or viewing the calendar invitation. Post-exploitation impact includes the potential for total system compromise, where an attacker can execute arbitrary commands, exfiltrate sensitive files, or install secondary malicious payloads on the victim's host."
}