---
id: "CVE-2026-118176"
kind: "vulnerability"
aliases: ["CVE-2026-118176"]
title: "Thunderbird on Windows: crafted email leaks NTLM credentials to attacker SMB server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["desktop", "package", "thunderbird", "windows"]
not_affected_if: ["non-windows", "patched-version"]
published_at: "2026-10-27T19:17:29+00:00"
first_seen_at: "2026-10-27T19:33:18+00:00"
updated_at: "2026-10-27T19:35:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118176", "first_seen_at": "2026-10-27T19:33:18+00:00"}]
---

# Thunderbird on Windows: crafted email leaks NTLM credentials to attacker SMB server

A crafted email bypasses Thunderbird's mailbox: URL check for remote Windows network shares using extended-length UNC paths. When the email is displayed, Thunderbird connects to an attacker-chosen SMB server, exposing the Windows account name and NTLM authentication data usable for offline password cracking or relay attacks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Thunderbird version, e.g. Help > About Thunderbird, and confirm it is below `159` or `153.6`
- Confirm the machine runs Windows; the sources say other operating systems are unaffected

## Fix

- Thunderbird: update to `159` or `153.6`, or later

## Timeline

- 2026-10-27T19:33:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118176

## From the sources

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_