Live › vulnerability › CVE-2026-118174
Go to dashboardThunderbird automatically fetched an external OpenPGP key attachment when a message was displayed, even with remote content blocking on. A sender can point that attachment at any URL, so opening the mail sends a request that can leak the user's NTLM credentials on Windows.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Anyone who reads mail in Thunderbird with an OpenPGP key attachment open-on-display, so any Thunderbird install on the mail path. The NTLM credential leak applies to Windows installs; other platforms get an unblocked remote request. Teams that read mail only in a webmail client or with the update already applied can skip it.
No product ranges from the sources yet.
153.6.0 or 159.0153.6 on the 153 branch or below 159 on newer branches159 or 153.6 or later, the versions named in the advisoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118174")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.