CVE-2026-118178 Details
Description
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A vulnerability exists in Mozilla Thunderbird that allows a remote RSS feed to change its stored subscription URL to a local file or network share location. This is achieved using the itunes:new-feed-url or newLocation element. Thunderbird reads the specified location with each feed update, which can lead to unauthorized access to local files. On Windows systems, this vulnerability also allows access to an attacker-controlled network share, potentially leaking the user's NTLM credentials. The issue has been fixed in Thunderbird versions 159 and 153.6.
Users can upgrade to Thunderbird versions 159 or 153.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://bugzilla.mozilla.org/show_bug.cgi?id=2075772 | [email protected] | Issue TrackingPermission RequiredVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-121/ | [email protected] | AdvisoryBundleRemedyVendor |
| https://www.mozilla.org/security/advisories/mfsa2026-122/ | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mozilla Thunderbird | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |