OpenPGP Key Attachment Vulnerability in Mozilla Thunderbird

CVE-2026-118174

What is CVE-2026-118174?

A vulnerability in Mozilla Thunderbird allows the automatic loading of OpenPGP key attachments, enabling an attacker to exploit remote content blocking features. When an attachment is marked with a URL pointing to a malicious source, Thunderbird bypasses user interaction and loads the content, potentially leaking NTLM credentials on Windows systems. This issue can result in unauthorized access to sensitive information. The vulnerability has been addressed in versions 153.6 and 159 of Thunderbird.

References