CVE-2026-113868 in Thunderbird
Summary
by MITRE • 10/20/2026
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The identified vulnerability represents a critical failure in input validation within the Simple Mail Transfer Protocol and Post Office Protocol version three client implementations, specifically affecting systems configured to use Network Challenge/Response authentication mechanisms such as NTLM or GSSAPI. The core technical flaw stems from an insufficient check of the base64 encoding integrity of server-supplied challenges during the authentication handshake process. In a standard secure implementation, any data received from an untrusted external source must be rigorously validated for format correctness before being processed further into cryptographic operations or memory allocation routines. By neglecting to verify that the incoming challenge constitutes valid base64 encoded data, the application proceeds with parsing logic that assumes well-formed input, leading to severe memory safety violations when malformed payloads are encountered.
This lack of validation manifests in two distinct and dangerous failure modes depending on the nature of the malicious payload sent by a rogue server acting as an intermediary or spoofed endpoint. In scenarios where the challenge is structurally invalid but not purely padding, the application fails to properly initialize allocated heap memory buffers before utilizing them for constructing the NTLM response message. Consequently, when the client constructs its authentication reply, it inadvertently copies uninitialized data from adjacent regions of the process heap into the outgoing packet. This results in an information disclosure vulnerability where sensitive contents of the local system's memory are transmitted over the network to the attacker-controlled server. Such leaked memory can contain cryptographic keys, session tokens, or other confidential user data that compromises the security posture of the entire environment.
A second variant of this flaw occurs when a malicious server sends a challenge consisting exclusively of base64 padding characters. In this specific case, the parsing logic miscalculates buffer boundaries due to the unexpected input structure, triggering an out-of-bounds read operation within the application's memory space. This type of error typically leads to immediate process instability and results in a denial of service condition as the Thunderbird client crashes unexpectedly. While less severe than information disclosure from a confidentiality standpoint, this crash capability allows for potential disruption of email services and can be leveraged in conjunction with other vulnerabilities to achieve arbitrary code execution if memory corruption patterns are further exploited by an attacker.
The operational impact is significant because it affects all accounts configured to use NTLM or GSSAPI authentication protocols. These mechanisms are commonly deployed in enterprise environments where single sign-on capabilities are required for seamless access to corporate mail servers. An attacker positioned on the network path, such as through a man-in-the-middle attack or by controlling a rogue SMTP/POP3 server within an internal network segment, can exploit this flaw without user interaction beyond establishing the connection. The vulnerability undermines the fundamental trust model of these authentication protocols and exposes users to both data exfiltration and service disruption risks.
To mitigate these risks, organizations must ensure that all Thunderbird clients are updated to version 158.0.1 or later, where this input validation logic has been corrected. In environments where immediate patching is not feasible, network-level controls should be implemented to restrict connections to known, trusted mail servers and prevent authentication attempts against unverified endpoints. Additionally, monitoring for unusual memory usage patterns or unexpected crashes in email clients can serve as an indicator of compromise during the transition period. This issue aligns with CWE-20 Improper Input Validation regarding the failure to sanitize server-supplied data and falls under ATT&CK technique T1557 Adversary-in-the-Middle, highlighting the importance of validating cryptographic challenges in secure communication channels.