---
id: "CVE-2026-113868"
kind: "vulnerability"
aliases: ["CVE-2026-113868"]
title: "Thunderbird: malicious NTLM server leaks heap memory and crashes client"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop", "email", "package", "thunderbird", "windows"]
not_affected_if: ["auth-not-ntlm", "imap-only", "no-ntlm-or-gssapi"]
published_at: "2026-10-20T20:17:19+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:24:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113868", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# Thunderbird: malicious NTLM server leaks heap memory and crashes client

Thunderbird did not validate that the NTLM challenge from a POP3 or SMTP server was valid base64. A malicious server can make Thunderbird send uninitialized heap memory back in its NTLM response, or send a padding-only challenge that crashes the client.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open Thunderbird and check Help > About Thunderbird for the version
- Check whether any mail account uses NTLM or GSSAPI authentication for POP3 or SMTP in account server settings

## Fix

- Update Thunderbird to `158.0.1` or `153.5.1`, or the later release on your branch

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113868

## From the sources

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_