CVE-2026-118174 in Thunderbird
Summary
by MITRE • 10/27/2026
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability represents a significant security flaw within Mozilla Thunderbird related to how the application handles OpenPGP key attachments, specifically concerning the automatic loading of external resources without user consent or adequate validation. The core technical issue stems from the email client's behavior when displaying messages that contain an attachment designated as an OpenPGP public key. In this scenario, Thunderbird automatically attempts to load and process the content of the attached file with the intent of offering the user the option to import the cryptographic key into their local keyring. However, the vulnerability arises because a malicious sender can manipulate the metadata of this attachment to classify it as an external resource pointing to an arbitrary Uniform Resource Locator rather than embedding the actual key data directly within the message or storing it locally. When such a message is rendered in the preview pane or opened for viewing, Thunderbird proceeds to fetch and load the content from the specified URL without requiring any explicit user interaction. This automatic retrieval mechanism effectively bypasses the application's remote content blocking features, which are designed to prevent scripts, images, and other external resources from loading automatically to protect users from tracking, phishing, and cross-site scripting attacks.
The operational impact of this vulnerability varies significantly depending on the operating system in use, with Windows environments facing a more severe consequence than Unix-like systems such as Linux or macOS. On Windows platforms, if an attacker constructs a malicious email containing an OpenPGP attachment that points to a URL referencing an SMB network share controlled by the adversary, Thunderbird will attempt to access this resource automatically. Because Windows handles authentication for UNC paths using NTLM hashing protocols, this automatic request triggers the operating system's credential negotiation process. Consequently, the user's current NTLM credentials are transmitted in cleartext or hashed form to the attacker-controlled server during the handshake phase of accessing the share. This results in a direct leak of sensitive authentication material that could be captured and subsequently used for pass-the-hash attacks or other lateral movement techniques within an enterprise network. For users on non-Windows operating systems, while NTLM credential leakage is not applicable due to different authentication mechanisms, the vulnerability still poses a risk by allowing arbitrary remote requests that circumvent content blocking policies, potentially leading to tracking, data exfiltration via beaconing, or exploitation of other vulnerabilities present in external services accessed through these unauthorized network calls.
From a classification perspective, this flaw aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if the NTLM leak is considered as an unintended exposure of authentication material, though it more accurately reflects CWE-15 External Control of System or Configuration Setting regarding how resources are loaded. In terms of MITRE ATT&CK mapping, this behavior corresponds to T1046 Network Service Discovery and potentially T1078 Valid Accounts if the NTLM credentials are harvested for unauthorized access. The vulnerability highlights a critical tension between user convenience features like automatic key importation and strict security boundaries that prevent silent network communication. To mitigate this risk, users must upgrade immediately to Thunderbird version 159 or version 153.6 where these issues have been addressed by the development team. Until such updates are applied, administrators should enforce policies that restrict email clients from processing external resources automatically and ensure that remote content blocking is set to its most restrictive level. Additionally, network-level controls such as firewalls can be configured to block outbound connections to unknown or untrusted SMB shares from mail client processes, thereby reducing the attack surface for credential theft even if the application flaw remains present in older versions.