Live › vulnerability › CVE-2026-118177
Go to dashboardWhen Thunderbird looks up calendars in a server directory during account setup or when adding a network calendar, it accepts locations pointing to other servers, local files or network shares. A malicious server or a network attacker on plain HTTP can make Thunderbird subscribe to such a location, leaking NTLM credentials on Windows and letting calendar changes overwrite files on the attacker's share or a local file.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 19:33 UTC. All times on this page are UTC.
Thunderbird users on Windows who set up accounts with calendar discovery or add network calendars are the most exposed, since NTLM credentials can leak. Users who do not use calendar discovery or network calendars, or who run a version at or above the fixed releases, can skip it.
No product ranges from the sources yet.
thunderbird --version on the command line159 or 153.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-118177")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.