{"id":"CVE-2026-113868","kind":"vulnerability","aliases":["CVE-2026-113868"],"related":[],"title":"Thunderbird: malicious NTLM server leaks heap memory and crashes client","description":"When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.","summary":"Thunderbird did not validate that the NTLM challenge from a POP3 or SMTP server was valid base64. A malicious server can make Thunderbird send uninitialized heap memory back in its NTLM response, or send a padding-only challenge that crashes the client.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","email","package","thunderbird","windows"],"not_affected_if":["auth-not-ntlm","imap-only","no-ntlm-or-gssapi"],"how_to_check":"- Open Thunderbird and check Help > About Thunderbird for the version\n- Check whether any mail account uses NTLM or GSSAPI authentication for POP3 or SMTP in account server settings","fix":"- Update Thunderbird to `158.0.1` or `153.5.1`, or the later release on your branch","status":"open","published_at":"2026-10-20T20:17:19+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T04:24:38+00:00","updated_at":"2026-10-25T04:24:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:24:38Z","model":"claude-haiku-5-5","output":{"fix":"- Update Thunderbird to `158.0.1` or `153.5.1`, or the later release on your branch","reach":"network","title":"Thunderbird: malicious NTLM server leaks heap memory and crashes client","impact":"medium","summary":"Thunderbird did not validate that the NTLM challenge from a POP3 or SMTP server was valid base64. A malicious server can make Thunderbird send uninitialized heap memory back in its NTLM response, or send a padding-only challenge that crashes the client.","category":"package","nicknames":[],"who_cares":["thunderbird","desktop","email","windows"],"confidence":0.7,"needs_auth":"no","worst_case":"Heap memory leaks to a malicious mail server, or Thunderbird crashes","analyst_note":"","how_to_check":"- Open Thunderbird and check Help > About Thunderbird for the version\n- Check whether any mail account uses NTLM or GSSAPI authentication for POP3 or SMTP in account server settings","needs_analyst":false,"not_affected_if":["imap-only","no-ntlm-or-gssapi","auth-not-ntlm"],"who_is_affected":"Only Thunderbird installs with POP3 or SMTP accounts that authenticate with NTLM or GSSAPI are affected. The memory disclosure applies only to NTLM, and the crash applies to both. Accounts using IMAP, or password or OAuth login, are not affected by this flaw as described in the sources.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3437,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113868':13A,16A '-2026':12A,15A '153.5.1':155C '158.0.1':152C 'account':131C 'affect':130C,144C 'also':119C 'authent':66C,138C 'back':49B 'base64':38B,86C,117C 'bound':125C 'caus':95C,120C 'challeng':29B,60B,83C,93C,113C 'check':78C 'client':10A,64B 'configur':132C 'consist':114C 'could':90C 'crash':9A,62B,127C 'cve':11A,14A 'desktop':17B 'disclos':106C 'disclosur':142C 'email':18B 'fix':149C 'gssapi':137C 'heap':6A,47B,100C 'includ':98C 'leak':5A 'make':43B 'malici':2A,40B,88C 'memori':7A,48B,101C,108C,141C 'ntlm':3A,28B,52B,74C,104C,135C,145C 'out-of-bound':122C 'packag':19B 'pad':58B,118C 'padding-on':57B 'pop3':32B,69C 'read':126C 'respons':53B,105C 'send':45B,55B,91C 'server':4A,35B,41B,72C,81C,89C,111C 'smtp':34B,71C 'thunderbird':1A,20B,22B,44B,75C,96C,128C,151C,154C 'uniniti':46B,99C,140C 'use':73C,134C 'valid':25B,37B,85C 'vulner':147C 'whether':79C 'window':21B","nicknames":[],"mitigations":[],"who_affected":"Only Thunderbird installs with POP3 or SMTP accounts that authenticate with NTLM or GSSAPI are affected. The memory disclosure applies only to NTLM, and the crash applies to both. Accounts using IMAP, or password or OAuth login, are not affected by this flaw as described in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113868","severity":null,"published_at":"2026-10-20T20:17:19+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}