{"id":"CVE-2026-118176","kind":"vulnerability","aliases":["CVE-2026-118176"],"related":[],"title":"Thunderbird on Windows: crafted email leaks NTLM credentials to attacker SMB server","description":"Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.\nThis bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","summary":"A crafted email bypasses Thunderbird's mailbox: URL check for remote Windows network shares using extended-length UNC paths. When the email is displayed, Thunderbird connects to an attacker-chosen SMB server, exposing the Windows account name and NTLM authentication data usable for offline password cracking or relay attacks.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","package","thunderbird","windows"],"not_affected_if":["non-windows","patched-version"],"how_to_check":"- Check the installed Thunderbird version, e.g. Help > About Thunderbird, and confirm it is below `159` or `153.6`\n- Confirm the machine runs Windows; the sources say other operating systems are unaffected","fix":"- Thunderbird: update to `159` or `153.6`, or later","status":"open","published_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:09+00:00","updated_at":"2026-10-27T19:35:09+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T19:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Thunderbird: update to `159` or `153.6`, or later","reach":"internet","title":"Thunderbird on Windows: crafted email leaks NTLM credentials to attacker SMB server","impact":"medium","summary":"A crafted email bypasses Thunderbird's mailbox: URL check for remote Windows network shares using extended-length UNC paths. When the email is displayed, Thunderbird connects to an attacker-chosen SMB server, exposing the Windows account name and NTLM authentication data usable for offline password cracking or relay attacks.","category":"package","nicknames":[],"who_cares":["thunderbird","windows","desktop"],"confidence":0.7,"needs_auth":"no","worst_case":"NTLM credentials and Windows account name leak to attacker SMB server","analyst_note":"Sources give no severity or exploitation status; check the Mozilla advisory for the CVSS score and the exact vulnerable version range before final rating.","how_to_check":"- Check the installed Thunderbird version, e.g. Help > About Thunderbird, and confirm it is below `159` or `153.6`\n- Confirm the machine runs Windows; the sources say other operating systems are unaffected","needs_analyst":true,"not_affected_if":["non-windows","patched-version"],"who_is_affected":"Only Thunderbird installations on Windows are affected, according to the sources. Exposure comes from displaying a specially crafted email, so any Windows user who opens such mail in an unpatched build is at risk. Systems on other operating systems can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000624,"input_tokens":3400,"output_tokens":567,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118176':15A,18A '-2026':14A,17A '153.6':159C '159':156C 'access':82C 'account':60B,121C 'affect':141C 'attack':10A,53B,73B,115C,137C 'attacker-chosen':52B 'authent':64B,125C 'bug':139C 'bypass':26B,91C 'caus':104C 'check':31B,76C 'chosen':54B,112C 'connect':49B,107C 'could':89C,103C,128C 'crack':70B,134C 'craft':4A,24B,101C 'credenti':8A 'cve':13A,16A 'data':65B,126C 'desktop':19B 'disclos':116C 'display':47B,98C 'email':5A,25B,45B,102C 'expos':57B 'extend':39B,94C 'extended-length':38B,93C 'file':83C 'fix':153C 'leak':6A 'length':40B,95C 'mailbox':29B,79C 'name':61B,122C 'network':35B,87C 'ntlm':7A,63B,124C 'offlin':68B,132C 'oper':146C 'packag':20B 'password':69B,133C 'path':42B,97C 'prevent':78C 'relay':72B,136C 'remot':33B,85C 'server':12A,56B,111C 'share':36B,88C 'smb':11A,55B,110C 'special':100C 'system':147C 'thunderbird':1A,21B,27B,48B,74C,105C,142C,155C,158C 'unaffect':149C 'unc':41B,96C 'url':30B,80C 'usabl':66B 'use':37B,92C,130C 'user':118C 'vulner':151C 'window':3A,22B,34B,59B,86C,120C,144C","nicknames":[],"mitigations":[],"who_affected":"Only Thunderbird installations on Windows are affected, according to the sources. Exposure comes from displaying a specially crafted email, so any Windows user who opens such mail in an unpatched build is at risk. Systems on other operating systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118176","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118176","severity":null,"published_at":"2026-10-27T19:17:29+00:00","modified_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}