Live › vulnerability › CVE-2026-113868
Go to dashboardThunderbird did not validate that the NTLM challenge from a POP3 or SMTP server was valid base64. A malicious server can make Thunderbird send uninitialized heap memory back in its NTLM response, or send a padding-only challenge that crashes the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Thunderbird installs with POP3 or SMTP accounts that authenticate with NTLM or GSSAPI are affected. The memory disclosure applies only to NTLM, and the crash applies to both. Accounts using IMAP, or password or OAuth login, are not affected by this flaw as described in the sources.
No product ranges from the sources yet.
158.0.1 or 153.5.1, or the later release on your branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-113868")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.