Live › vulnerability › CVE-2026-118176
Go to dashboardA crafted email bypasses Thunderbird's mailbox: URL check for remote Windows network shares using extended-length UNC paths. When the email is displayed, Thunderbird connects to an attacker-chosen SMB server, exposing the Windows account name and NTLM authentication data usable for offline password cracking or relay attacks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Only Thunderbird installations on Windows are affected, according to the sources. Exposure comes from displaying a specially crafted email, so any Windows user who opens such mail in an unpatched build is at risk. Systems on other operating systems can skip it.
No product ranges from the sources yet.
159 or 153.6159 or 153.6, or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118176")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.