CVE-2026-118175 in Thunderbird
Summary
by MITRE • 10/27/2026
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability represents a critical information disclosure flaw within Mozilla Thunderbird, specifically affecting email composition workflows such as replying, forwarding, or editing messages as new. The core technical issue stems from improper handling of message parts when multiple emails are stored in the same local folder. Under normal operation, an email client isolates the content being composed to prevent leakage of unrelated data. However, due to a logic error in how Thunderbird references and embeds attachments or body parts during these specific composition actions, it fails to correctly scope the selection to only the intended message. Instead, the application inadvertently includes fragments from other messages residing in the same directory context into the draft being created. This behavior indicates a failure in input validation and state isolation within the email client's rendering engine when processing multi-part MIME structures or local folder indexes.
The operational impact of this vulnerability is significant because it facilitates unauthorized data exfiltration without user consent. Since the flaw occurs during composition, the affected content becomes part of the outgoing message payload if the user proceeds to send the draft. Consequently, recipients receive an email containing sensitive information from a different source that was never intended for them. This could include personal identifiers, confidential business communications, or private correspondence stored locally on the victim's machine. The severity is compounded by the fact that Thunderbird does not display any blocked content warnings or security alerts to indicate that extraneous data has been included in the message body or attachments. Users may remain unaware of the leakage until after transmission, making remediation difficult and potentially leading to compliance violations regarding privacy regulations such as GDPR or HIPAA depending on the nature of the disclosed data.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure, where sensitive information is accessible to an unauthorized actor without explicit permission. It also relates to CWE-841: Improper Enforcement of Message Integrity During Process Switching if interpreted as a failure in maintaining context boundaries between different message objects during the composition process. In terms of adversary tactics, this flaw could be leveraged within ATT&CK technique T1005: Data from Local System, where an attacker might craft a malicious email designed to trigger this embedding behavior when opened or interacted with by a target user. By exploiting this bug, an attacker could potentially harvest sensitive data stored in the victim's local mail folders through social engineering tactics that encourage replying or forwarding specific crafted messages.
Mitigation strategies primarily involve immediate software updates as the vulnerability has been addressed in Thunderbird versions 159 and 153.6. Organizations should enforce automated patch management policies to ensure all client installations are updated to these fixed versions promptly. In environments where immediate updating is not feasible, administrators can implement network-level controls such as Data Loss Prevention (DLP) solutions that inspect outgoing email content for anomalies or unexpected attachments derived from local file systems. Additionally, user awareness training should emphasize the importance of reviewing composed messages thoroughly before sending, although this is a secondary control given the lack of explicit warnings in the interface. Security teams should also monitor for any reports of unusual data exfiltration patterns originating from mail clients to detect potential exploitation attempts that may have occurred prior to patch deployment.