Security Flaw in Thunderbird Affects User Privacy and Network Safety

CVE-2026-118179

What is CVE-2026-118179?

A significant security vulnerability in Thunderbird allows arbitrary command execution via crafted news or snews links. When users click on these links referencing specific message-IDs, the application connects to untrusted servers without prompting, which could lead to the exposure of private data and unintended network access. Lines breaks in these message-IDs are transmitted unmodified, enabling malicious actors to exploit this flaw to execute unwanted commands on reachable services. The vulnerability has been addressed in Thunderbird versions 159 and 153.6, enhancing user security and network integrity.

References