CVE-2026-118176 Details
Description
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A vulnerability in Mozilla Thunderbird on Windows allows extended-length UNC paths to bypass restrictions on mailbox: URLs, which normally prevent access to files on remote Windows network shares. This flaw could be exploited by displaying a specially crafted email, causing Thunderbird to connect to an attacker-chosen SMB server. As a result, the user's Windows account name and NTLM authentication data would be disclosed, potentially leading to offline password cracking or relay attacks. This issue does not affect other operating systems.
Users can upgrade to Thunderbird version 159 or Thunderbird 153.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=2081141 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-121/ | [email protected] | AdvisoryBundleRemedyVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-122/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mozilla Thunderbird | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |