Security Vulnerability in Thunderbird by Mozilla Leading to Potential Credential Exposure

CVE-2026-118176

What is CVE-2026-118176?

A security flaw in Mozilla's Thunderbird email client for Windows allows attackers to bypass URL checks that prevent unauthorized access to remote Windows network shares. By exploiting this vulnerability with specially crafted emails containing extended-length Universal Naming Convention (UNC) paths, malicious actors can compel Thunderbird to connect to a rogue SMB server. This connection could inadvertently expose crucial user data, including Windows account names and NTLM authentication details, rendering users susceptible to offline password attacks or relay attacks. The issue has been addressed in the latest Thunderbird updates, 159 and 153.6.

References