NTLM Authentication Flaw in Thunderbird by Mozilla

CVE-2026-113868

What is CVE-2026-113868?

A security flaw in Mozilla's Thunderbird during NTLM and GSSAPI authentication allows a malicious server to send an invalid base64 challenge. This exploitation can lead to the disclosure of uninitialized heap memory in the NTLM response, potentially exposing sensitive information to the server. Additionally, a challenge that consists solely of base64 padding can trigger an out-of-bounds read, resulting in the application crashing. This vulnerability impacts users with accounts configured for NTLM or GSSAPI authentication, necessitating an update to Thunderbird versions 158.0.1 or 153.5.1 to mitigate the risks.

References