Remote Code Execution Vulnerability in Mozilla Thunderbird

CVE-2026-118178

What is CVE-2026-118178?

A vulnerability in Mozilla Thunderbird allows an attacker to manipulate the RSS feed subscription URL using specific XML elements. This results in the application accessing local files, potentially exposing sensitive information. Notably, on Windows systems, the vulnerability could lead to the leakage of NTLM credentials if an attacker can modify the feed or control the network share. Other operating systems are affected by local file access without the credential leakage. The issue was addressed in Thunderbird versions 159 and 153.6.

References