{"id":"CVE-2026-126132","kind":"vulnerability","aliases":["CVE-2026-126132"],"related":[],"title":"Thunderbird on Linux and Windows can leak local files when composing mail","description":"When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider.\nThis bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160.","summary":"When a message was forwarded inline, edited as new, or had an attachment dragged into compose, a crafted .desktop, .url or .lnk link attachment was swapped for the content of the file or URL it points to. That can send local files or internal network content to message recipients or the mail provider.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Thunderbird","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["email","linux","other","thunderbird","windows"],"not_affected_if":["macos","thunderbird-160-or-later"],"how_to_check":"- Check the installed Thunderbird version (Help > About Thunderbird) and compare it with `160`.\n- Confirm the platform is Linux or Windows; the sources say macOS is unaffected.","fix":"- Thunderbird: move to `160` or later.","status":"open","published_at":"2026-11-10T19:21:13+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","triaged_at":"2026-11-10T20:04:52+00:00","updated_at":"2026-11-10T20:04:52+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T20:04:52Z","model":"claude-haiku-5-5","output":{"fix":"- Thunderbird: move to `160` or later.","reach":"network","title":"Thunderbird on Linux and Windows can leak local files when composing mail","impact":"medium","summary":"When a message was forwarded inline, edited as new, or had an attachment dragged into compose, a crafted .desktop, .url or .lnk link attachment was swapped for the content of the file or URL it points to. That can send local files or internal network content to message recipients or the mail provider.","audience":"everyone","category":"other","nicknames":[],"who_cares":["thunderbird","linux","windows","email"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"local files and internal network content leak to recipients","analyst_note":"","how_to_check":"- Check the installed Thunderbird version (Help > About Thunderbird) and compare it with `160`.\n- Confirm the platform is Linux or Windows; the sources say macOS is unaffected.","plain_action":"Update Thunderbird to version 160 or later, using Help > About Thunderbird to check for updates.","product_name":"Thunderbird","needs_analyst":false,"not_affected_if":["macos","thunderbird-160-or-later"],"who_is_affected":"Only Thunderbird users on Linux and Windows are affected, per the sources. The flaw needs a crafted link attachment to be carried into a composed message, which the sources describe as happening during forward, edit-as-new, or drag-and-drop of attachments. Users on macOS and other systems can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4623,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126132':15A,18A '-2026':14A,17A '160':175C 'affect':158C 'attach':37B,48B,90C,100C 'bug':156C 'compos':11A,40B,94C 'content':53B,70B,118C,140C 'could':135C 'craft':42B,98C 'cve':13A,16A 'desktop':43B,102C 'disclos':136C 'drag':38B,91C 'edit':31B,84C 'email':20B 'file':9A,56B,66B,103C,111C,121C,138C 'fix':172C 'forward':29B,82C 'inlin':30B,83C 'intern':68B 'leak':7A 'link':47B,99C 'linux':3A,21B,105C,161C 'lnk':46B,110C 'local':8A,65B,137C 'mail':12A,76B,153C 'messag':27B,72B,80C,129C,148C 'network':69B,145C 'new':33B,86C 'oper':165C 'point':60B,125C 'provid':77B,154C 'recipi':73B,149C 'replac':115C 'save':131C 'send':64B 'sent':133C 'special':97C 'swap':50B 'system':166C 'thunderbird':1A,19A,23B,159C,174C 'unaffect':168C 'url':44B,58B,108C,123C 'user':143C 'vulner':170C 'window':5A,24B,95C,113C,163C","nicknames":[],"mitigations":[],"who_affected":"Only Thunderbird users on Linux and Windows are affected, per the sources. The flaw needs a crafted link attachment to be carried into a composed message, which the sources describe as happening during forward, edit-as-new, or drag-and-drop of attachments. Users on macOS and other systems can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Thunderbird to version 160 or later, using Help > About Thunderbird to check for updates.","pkeys":["thunderbird"],"ptokens":["thunderbird"],"labels":["email","linux","medium","other","thunderbird","vendor","windows"],"campaign_type":null,"search_a":"'-126132':15A,18A '-2026':14A,17A 'compos':11A 'cve':13A,16A 'file':9A 'leak':7A 'linux':3A 'local':8A 'mail':12A 'thunderbird':1A,19A 'window':5A","search_b":"'attach':37B,48B 'compos':40B 'content':53B,70B 'craft':42B 'desktop':43B 'drag':38B 'edit':31B 'email':20B 'file':56B,66B 'forward':29B 'inlin':30B 'intern':68B 'link':47B 'linux':21B 'lnk':46B 'local':65B 'mail':76B 'messag':27B,72B 'network':69B 'new':33B 'point':60B 'provid':77B 'recipi':73B 'send':64B 'swap':50B 'thunderbird':23B 'url':44B,58B 'window':24B","search_c":"'160':175C 'affect':158C 'attach':90C,100C 'bug':156C 'compos':94C 'content':118C,140C 'could':135C 'craft':98C 'desktop':102C 'disclos':136C 'drag':91C 'edit':84C 'file':103C,111C,121C,138C 'fix':172C 'forward':82C 'inlin':83C 'link':99C 'linux':105C,161C 'lnk':110C 'local':137C 'mail':153C 'messag':80C,129C,148C 'network':145C 'new':86C 'oper':165C 'point':125C 'provid':154C 'recipi':149C 'replac':115C 'save':131C 'sent':133C 'special':97C 'system':166C 'thunderbird':159C,174C 'unaffect':168C 'url':108C,123C 'user':143C 'vulner':170C 'window':95C,113C,163C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126132","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126132","severity":null,"published_at":"2026-11-10T19:21:13+00:00","modified_at":"2026-11-10T19:21:13+00:00","first_seen_at":"2026-11-10T19:25:15+00:00","fetched_at":"2026-11-10T19:25:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}