{"id":"CVE-2026-118175","kind":"vulnerability","aliases":["CVE-2026-118175"],"related":[],"title":"Thunderbird: crafted email can leak another message from the same folder","description":"When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","summary":"When a user replies to, forwards, or edits a crafted email as new, Thunderbird can embed parts of a different message stored in the same folder into the draft without showing a blocked-content warning. If the user sends that draft, the content of the other message is disclosed to the recipients.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop-email","end-users","package","thunderbird"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` where available.\n- Check whether the installed version is below `159` or `153.6`.","fix":"- Update Thunderbird to `159` or to `153.6` or later on the 153 line.","status":"open","published_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:09+00:00","updated_at":"2026-10-27T19:35:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T19:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update Thunderbird to `159` or to `153.6` or later on the 153 line.","reach":"internet","title":"Thunderbird: crafted email can leak another message from the same folder","impact":"medium","summary":"When a user replies to, forwards, or edits a crafted email as new, Thunderbird can embed parts of a different message stored in the same folder into the draft without showing a blocked-content warning. If the user sends that draft, the content of the other message is disclosed to the recipients.","category":"package","nicknames":[],"who_cares":["thunderbird","desktop-email","end-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Parts of another email in the same folder get disclosed to recipients.","analyst_note":"","how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` where available.\n- Check whether the installed version is below `159` or `153.6`.","needs_analyst":false,"not_affected_if":["patched-version"],"who_is_affected":"Anyone running Thunderbird versions before 159 or 153.6 who replies to, forwards, or edits untrusted email. The sources do not say which configurations are required beyond this, so the exact trigger conditions are unknown. Users on patched releases can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000575,"input_tokens":3327,"output_tokens":484,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118175':14A,17A '-2026':13A,16A '153.6':141C '159':138C 'anoth':6A 'block':59B,112C 'blocked-cont':58B 'compos':108C 'content':60B,69B,113C,122C 'could':92C 'craft':2A,35B,86C 'cve':12A,15A 'desktop':19B 'desktop-email':18B 'differ':45B,97C 'disclos':75B,128C 'draft':54B,67B 'edit':33B,84C 'email':3A,20B,36B,87C 'emb':41B,93C 'end':22B 'end-us':21B 'fix':135C 'folder':11A,51B,103C 'forward':31B,82C 'leak':5A 'messag':7A,46B,73B,88C,98C,106C,120C,126C 'new':38B,90C 'packag':24B 'part':42B,94C 'recipi':78B,131C 'repli':29B,80C 'send':65B 'sent':118C 'show':56B,110C 'store':47B,99C 'thunderbird':1A,25B,39B,91C,137C,140C 'user':23B,28B,64B,117C 'vulner':133C 'warn':61B,114C 'without':55B,109C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Thunderbird versions before 159 or 153.6 who replies to, forwards, or edits untrusted email. The sources do not say which configurations are required beyond this, so the exact trigger conditions are unknown. Users on patched releases can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118175","severity":null,"published_at":"2026-10-27T19:17:29+00:00","modified_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}