CVE-2026-118175
published 2026-10-27CVE-2026-118175: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into…
PriorityP423medium4.3
EPSS
0.18%
7.5th percentile
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 153.6 | Thunderbird 153.6 |
| mozilla | thunderbird | < Thunderbird 159 | Thunderbird 159 |
| mozilla | thunderbird | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
thunderbird: thunderbird: Information disclosure via crafted email message
vendor_redhat·2026-10-27·CVSS 4.3
CVE-2026-118175 [MEDIUM] CWE-201 thunderbird: thunderbird: Information disclosure via crafted email message
thunderbird: thunderbird: Information disclosure via crafted email message
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A flaw was found in Thunderbird. When a user replies to, forwards, or edits a specially crafted email message, Thunderbird can improperly embed portions of a different message stored in the same folder into the draft without displaying a content warning. If the user sends the email, sensitive content from the unrelated message
Mozilla
Mozilla Foundation Security Advisory 2026-122: CVE-2026-118175
vendor_mozilla
CVE-2026-118175 Mozilla Foundation Security Advisory 2026-122: CVE-2026-118175
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-118175
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
Mozilla
Mozilla Foundation Security Advisory 2026-121: CVE-2026-118175
vendor_mozilla
CVE-2026-118175 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118175
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118175
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
VulDB
Mozilla Thunderbird up to 153.5/158 information disclosure (Nessus ID 372632)
vuldb·2026-10-28
CVE-2026-118175 [LOW] Mozilla Thunderbird up to 153.5/158 information disclosure (Nessus ID 372632)
A vulnerability identified as problematic has been detected in Mozilla Thunderbird up to 153.5/158. This issue affects some unknown processing. The manipulation leads to information disclosure.
This vulnerability is documented as CVE-2026-118175. The attack can be initiated remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing
ghsa_unreviewed·2026-10-27
CVE-2026-118175 When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
No detection rules found.
No public exploits indexed.
2026-10-27
Published