CVE-2026-118176
published 2026-10-27CVE-2026-118176: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths…
PriorityP335
EPSS
0.22%
12.3th percentile
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | thunderbird | < Thunderbird 153.6 | Thunderbird 153.6 |
| mozilla | thunderbird | < Thunderbird 159 | Thunderbird 159 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Mozilla
Mozilla Foundation Security Advisory 2026-122: CVE-2026-118176
vendor_mozilla
CVE-2026-118176 Mozilla Foundation Security Advisory 2026-122: CVE-2026-118176
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-118176
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
Mozilla
Mozilla Foundation Security Advisory 2026-121: CVE-2026-118176
vendor_mozilla
CVE-2026-118176 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118176
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118176
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
VulDB
Mozilla Thunderbird up to 153.5/158 Mailbox URL improper authentication (Nessus ID 372632)
vuldb·2026-10-28
CVE-2026-118176 [LOW] Mozilla Thunderbird up to 153.5/158 Mailbox URL improper authentication (Nessus ID 372632)
A vulnerability was found in Mozilla Thunderbird up to 153.5/158. It has been rated as problematic. This affects an unknown part of the component Mailbox URL Handler. Performing a manipulation results in improper authentication.
This vulnerability is cataloged as CVE-2026-118176. It is possible to initiate the attack remotely. There is no exploit available.
Upgrading the affected component is advised.
GHSA
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.
ghsa_unreviewed·2026-10-27
CVE-2026-118176 Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
No detection rules found.
No public exploits indexed.
2026-10-27
Published