I don't think it matters whether your PC is a server, attacks using publicly known exploits are generally indiscriminate. Re: CVE-2019-17026 - Mozilla themselv

I don't think it matters whether your PC is a server, attacks using publicly known exploits are generally indiscriminate. Re: CVE-2019-17026 - Mozilla themselves state that it affects Thunderbird, but you're right, these JS issues might not be possible to exploit with just a malicious email as the attack vector. So how about CVE-2019-11703, CVE-2019-11704, CVE-2019-11705 (aka MFSA2019-17)? It's a serious issue that gives RCE in Thunderbird 52.9.1. Is this issue reachable from an *.ics attachment, or will something happen without interaction if you have Lightning installed or receive a malicious calendar invite? This is still quite new and the bugzilla is still private. CVE-2019-11713 gives RCE if any embedded images are reached over HTTP/2, that seems very plausible. At least you have the defense that images aren't loaded by default. Do you ever load images in emails? CVE-2018-18500 is an older RCE but unpatched as well. This one is really interesting - I don't know if custom HTML elements are rendered in emails, but this issue happens in the parser before rendering so it's probably exploitable, the HTML is always parsed at least. Less interesting but still plausible are the ones like CVE-2019-11740 and CVE-2019-11709 and their ilk, there's a new one of these with every Firefox platform update where nobody has (publicly) researched the details, but the patch is there for reversing so given the economic calculus I'm sure someone out there has put the effort in. And finishing off with CVE-2019-11707 and other Javascript things like that, if you have any extensions installed that can be convinced to call the affected function in an exploitable way. If you're stuck on 52.x it's likely for extension reasons, and it's also likely your extensions themselves are no longer getting updates and have their own attack surface. Having looked into the list of CVEs more closely, this is an impressively short list for a 18-month old version of any program (skipping over all the XSS issues and sandbox escapes). But I would give up extensions in a heartbeat versus trusting my personal email account to any one of these.