{"id":"CVE-2026-118177","kind":"vulnerability","aliases":["CVE-2026-118177"],"related":[],"title":"Thunderbird: calendar discovery accepts remote and local locations, leaking NTLM","description":"When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.","summary":"When Thunderbird looks up calendars in a server directory during account setup or when adding a network calendar, it accepts locations pointing to other servers, local files or network shares. A malicious server or a network attacker on plain HTTP can make Thunderbird subscribe to such a location, leaking NTLM credentials on Windows and letting calendar changes overwrite files on the attacker's share or a local file.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["calendar","package","thunderbird","windows"],"not_affected_if":["fixed-version","no-calendar-discovery"],"how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` on the command line\n- Check whether Thunderbird is used on Windows with calendars discovered from a server or added as network calendars","fix":"- Update Thunderbird to `159` or `153.6` or later","status":"open","published_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","triaged_at":"2026-10-27T19:35:09+00:00","updated_at":"2026-10-27T19:35:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T19:35:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update Thunderbird to `159` or `153.6` or later","reach":"network","title":"Thunderbird: calendar discovery accepts remote and local locations, leaking NTLM","impact":"medium","summary":"When Thunderbird looks up calendars in a server directory during account setup or when adding a network calendar, it accepts locations pointing to other servers, local files or network shares. A malicious server or a network attacker on plain HTTP can make Thunderbird subscribe to such a location, leaking NTLM credentials on Windows and letting calendar changes overwrite files on the attacker's share or a local file.","category":"package","nicknames":[],"who_cares":["thunderbird","windows","calendar"],"confidence":0.6,"needs_auth":"no","worst_case":"NTLM credentials leak and local files get overwritten by calendar sync","analyst_note":"","how_to_check":"- Check the installed Thunderbird version under Help > About Thunderbird, or run `thunderbird --version` on the command line\n- Check whether Thunderbird is used on Windows with calendars discovered from a server or added as network calendars","needs_analyst":false,"not_affected_if":["fixed-version","no-calendar-discovery"],"who_is_affected":"Thunderbird users on Windows who set up accounts with calendar discovery or add network calendars are the most exposed, since NTLM credentials can leak. Users who do not use calendar discovery or network calendars, or who run a version at or above the fixed releases, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000615,"input_tokens":3400,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118177':13A,16A '-2026':12A,15A '153.6':190C '159':187C 'accept':4A,40B,110C 'account':31B,100C 'add':35B,104C 'attack':57B,82B,128C,156C,173C 'attacker-control':155C 'calendar':2A,17B,25B,38B,76B,92C,108C,111C,161C,167C 'chang':77B,164C 'control':157C 'could':135C,146C,168C 'credenti':71B,152C 'cve':11A,14A 'directori':29B,95C 'discoveri':3A 'everi':160C 'file':47B,79B,88B,118C,180C 'fix':184C 'host':158C 'http':60B,134C 'leak':9A,69B,147C 'let':75B 'local':7A,46B,87B,117C,179C 'locat':8A,41B,68B,112C,142C 'look':23B,90C 'lookup':131C 'make':62B,136C 'malici':52B,123C 'network':37B,49B,56B,107C,120C,127C 'new':106C 'ntlm':10A,70B,151C 'overwrit':78B,177C 'packag':18B 'plain':59B,133C 'point':42B,113C 'refresh':162C 'remot':5A 'server':28B,45B,53B,98C,116C,124C 'setup':32B,101C 'share':50B,84B,121C,175C 'subscrib':64B,138C 'thunderbird':1A,19B,22B,63B,109C,137C,186C,189C 'use':132C 'user':149C 'vulner':182C 'window':20B,73B,144C 'written':170C","nicknames":[],"mitigations":[],"who_affected":"Thunderbird users on Windows who set up accounts with calendar discovery or add network calendars are the most exposed, since NTLM credentials can leak. Users who do not use calendar discovery or network calendars, or who run a version at or above the fixed releases, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T19:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118177","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118177","severity":null,"published_at":"2026-10-27T19:17:29+00:00","modified_at":"2026-10-27T19:17:29+00:00","first_seen_at":"2026-10-27T19:33:18+00:00","fetched_at":"2026-10-27T19:33:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}