Thunderbird Fixes Unwanted Connections and Message Leaks
Thunderbird’s latest desktop security updates address more than malicious content inside an email. Displaying a message can trigger an unwanted connection, a reply can carry material from another message, and calendar or feed discovery can change where the application reads or writes. Several paths can expose Windows authentication material. The operating system, configured feature and user action matter when assessing each finding.
Mozilla announced the corrections in Thunderbird 159 and 153.6 on 27 October. The official desktop release notes list 159.0 and 153.6.0esr. Those are separate release channels. This review focuses on their mail, network and authentication boundaries, rather than treating every shared browser-engine fix as exploitable through ordinary email.
Displaying and replying are different attack paths
For CVE-2026-118174, displaying a message containing an OpenPGP key attachment could make Thunderbird retrieve an attacker-selected location automatically. The application loaded the key content to offer an import, but an external attachment could point elsewhere and bypass remote-content blocking. Accepting the key was not required. On Windows, a network-share destination could expose NTLM credentials. On other systems, the described consequence was an unwanted remote request. This is an attachment-handling flaw, not evidence that OpenPGP’s encryption was broken.
A separate Windows-only finding, CVE-2026-118176, concerns extended-length network-share paths in mailbox URLs. A crafted email could bypass the restriction on remote Windows shares and make the client contact an attacker’s SMB server. The disclosed material includes the Windows account name and NTLM authentication data, which could support password-cracking or relay attempts. Authentication material leaving a device does not, by itself, prove that an attacker obtained a clear-text password or successfully used it.
CVE-2026-118175 instead involves composing a response. Replying to, forwarding or editing a crafted message as new could insert content from another message in the same folder without a blocked-content warning. Disclosure occurred if the user then sent that composition. That condition matters: the advisory does not describe an unauthenticated reader browsing the whole mailbox, or exposure being complete merely because the crafted message arrived.
Calendar and feed destinations can persist
The calendar-discovery problem, CVE-2026-118177, could make Thunderbird subscribe to locations on another server, a local file or a network share. A malicious server could supply the destination during account setup or the addition of a network calendar. A network attacker could also interfere when discovery used plain HTTP. On Windows, subsequent refreshes could expose NTLM credentials, while calendar changes could be written to the attacker’s share or overwrite a local file. The subscription and later refreshes belong in the investigation, not just the initial setup event.
An RSS feed could similarly replace its stored subscription address under CVE-2026-118178. A malicious feed, or an attacker able to alter a feed delivered over HTTP, could redirect it to a local-file address that Thunderbird would read on later updates. Windows added the risk of contacting an attacker-controlled share and leaking NTLM credentials. Other operating systems remained affected by the local-file-read issue. Do not generalise the Windows credential consequence to every platform, or dismiss the other platforms as unaffected.
Chat has its own condition. CVE-2026-118180 concerns a malicious or compromised Matrix homeserver returning an unchecked address during login. A file-address response could redirect subsequent session requests, with an attacker-controlled Windows share exposing NTLM credentials. Mozilla limits that credential-leak consequence to Windows and marks other operating systems unaffected for this finding. It should not be treated as an ordinary email-reading vulnerability.
CVE-2026-118179 requires clicking a news or secure-news link. Thunderbird could connect to the supplied host and port without checking that it was a configured news server. Unfiltered line breaks in the message identifier could carry commands to reachable services. The secure-news path also connected to such servers without TLS. A familiar-looking protocol label therefore did not establish either the intended destination or an encrypted connection.
The correction date differs between branches
The ESR notice also includes CVE-2026-110247, an integer-overflow problem when growing buffers for sufficiently large messages, and CVE-2026-113869, a potentially exploitable crash during S/MIME decryption while a security-device password prompt remained open. Mozilla’s original records place their regular-channel corrections in 158 and 158.0.1 respectively, while both reach the ESR line in 153.6. The October ESR list is not evidence that every listed issue was first corrected in regular release 159.
The older 20 October updates also addressed Exchange account-setup credentials, automatic XMPP chat replies and POP3 or SMTP authentication challenges. Their prerequisites remain relevant background, but 153.5.1 and 158.0.1 are historical release references. Use the current supported update offered for the installed channel. Keep Mozilla’s generic warning that many browser-engine flaws cannot be exploited through mail separate from its explicit descriptions of the mail, calendar, feed and Windows paths above.
Verify the running client and investigate earlier exposure
Identify the installed desktop build, operating system, update channel and enabled mail, calendar, feed and chat features. Where a distributor or managed software service supplies Thunderbird, confirm its applicable package and delivery guidance. Deploy through the authorised route, restart as required and verify the build actually running. Then check legitimate account access, message composition, calendar synchronisation and the features the organisation relies on. These are verification priorities, not a claim that BlackTree has tested an organisation’s devices.
Where earlier exposure is suspected, preserve relevant evidence and review unexpected destinations, subscriptions and authentication activity with the responsible security team. Updating the client does not revoke credentials that have already left it or establish that earlier messages were never disclosed. Keep the separate eMudhra certificate-trust response in scope too. A corrected mail feature and a verified trust-store response answer different questions.
