CVE-2026-84637: Thunderbird calendar invitations could launch executables on Windows.
A file URI attachment in a malicious invite bypasses Thunderbird's executable attachment protections and can show a misleading filename. The victim opens the invite, the attacker runs arbitrary
