CVE-2026-118176 in Thunderbird
Summary
by MITRE • 10/27/2026
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability resides within Mozilla Thunderbird's URL parsing logic, specifically concerning the validation mechanisms for mailbox URLs that attempt to access files on remote Windows network shares via Universal Naming Convention paths. The core technical flaw is a bypass of security checks designed to prevent local file system access through remote protocols. This failure occurs when an attacker utilizes extended-length UNC paths, which exceed standard length limitations or utilize specific formatting variations that the existing validation routines fail to properly sanitize or reject. By exploiting this parsing inconsistency, Thunderbird can be tricked into treating a maliciously crafted network share path as a legitimate local resource access request, effectively bypassing the sandbox restrictions intended to isolate email content from system-level file operations.
The operational impact of this vulnerability is significant for users running Thunderbird on Microsoft Windows operating systems, while other platforms remain unaffected due to differences in underlying file system architectures and URL handling implementations. When a user views an email containing the specially crafted malicious payload, the application initiates a connection to an SMB server controlled by the attacker rather than restricting access as intended. This unauthorized network interaction results in the disclosure of sensitive authentication credentials, specifically the Windows account name and NTLM hash data. The exposure of these credentials poses a severe security risk because they can be harvested for offline password cracking attacks or leveraged in pass-the-hash relay attacks to gain unauthorized access to other systems within the same domain or trust relationship.
From an industry standard perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Dangerous Method or Function, as it involves a failure to correctly validate input data (the URL path) leading to unintended system behavior. In terms of threat modeling frameworks such as MITRE ATT&CK, the exploitation technique corresponds to T1556 Modification of Authentication Process, specifically through credential harvesting via NTLM relay scenarios. The attacker's ability to force an authentication exchange with a rogue server facilitates lateral movement and privilege escalation within enterprise environments where Windows network shares are commonly used for file storage and collaboration.
Mitigation strategies primarily involve applying the software updates released by Mozilla that address this parsing flaw. Users must upgrade to Thunderbird version 159 or later, or alternatively update to the extended support release branch at version 153.6 or higher, where these validation checks have been hardened against extended-length UNC path bypasses. In environments where immediate patching is not feasible, administrators should consider implementing network-level controls such as SMB signing enforcement and restricting outbound connections from email clients to untrusted IP addresses using firewall rules. Additionally, enforcing strong password policies and multi-factor authentication can reduce the effectiveness of offline cracking attempts if credentials are compromised, although preventing the initial credential leak through software updates remains the most effective defense against this specific vector.