CVE-2026-118177 Details
Description
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A vulnerability in Mozilla Thunderbird's calendar discovery feature could lead to the unintentional subscription to malicious calendar locations. During account setup or when adding a new network calendar, Thunderbird accepted calendar locations from various sources, including other servers, local files, and network shares. This issue could be exploited by a malicious server or a network attacker, particularly when the lookup was conducted over plain HTTP. On Windows systems, this vulnerability could cause the leakage of NTLM credentials to an attacker-controlled host with each calendar refresh. Additionally, changes made to the subscribed calendar could be directed to the attacker's network share or overwrite a local file. This vulnerability has been addressed in Thunderbird versions 159 and 153.6.
Users can upgrade to Thunderbird version 159 or 153.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=2080924 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-121/ | [email protected] | AdvisoryBundleRemedyVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-122/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mozilla Thunderbird | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |