CVE-2026-118177 in Thunderbird
Summary
by MITRE • 10/27/2026
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability represents a critical flaw in how Mozilla Thunderbird handles resource location validation during the configuration of calendar services, specifically affecting versions prior to 159 and 153.6. The core technical deficiency lies in the application's failure to enforce strict origin or domain restrictions when processing user-provided calendar URLs. During account setup or the addition of a new network calendar, Thunderbird accepts arbitrary location strings without sufficient sanitization or validation against expected server contexts. This architectural oversight allows an attacker to inject malicious targets into the subscription process, effectively bypassing standard security boundaries that are typically designed to prevent cross-origin data exfiltration and unauthorized file system interactions.
From a technical perspective, this flaw enables several distinct attack vectors depending on the protocol used for the calendar lookup. When the initial request is made over plain HTTP, which lacks encryption and integrity protection, a network attacker positioned in the path of communication can perform man-in-the-middle attacks to redirect the subscription target. More critically, when Thunderbird interacts with servers that support NTLM authentication, such as Microsoft Exchange or Windows Server shares, the application automatically includes the user's current credentials in subsequent requests if it perceives them as belonging to a trusted domain context. By tricking the user into subscribing to a calendar hosted on an attacker-controlled server within the same perceived realm, Thunderbird inadvertently transmits NTLM hashes or challenge-response tokens to that malicious host every time the calendar data is refreshed. This behavior constitutes a severe credential leakage vulnerability, allowing attackers to capture authentication material offline for potential cracking or relay attacks against other systems in the network.
The operational impact of this vulnerability extends beyond simple information disclosure. Because Thunderbird allows subscriptions pointing to local file paths and Windows network shares (SMB), an attacker who successfully manipulates the calendar location can achieve remote code execution-like effects through data manipulation rather than direct shell access. Specifically, changes made by the user within the maliciously subscribed calendar interface are written back to the specified target path. If the target is a writable directory on an attacker-controlled network share, this results in unauthorized file creation or modification, which can be leveraged for further lateral movement or persistence mechanisms. Furthermore, if the location points to a local file system path with write permissions, it enables arbitrary file overwrites on the victim's machine. This capability allows attackers to overwrite critical configuration files, scripts, or documents, potentially leading to privilege escalation or data corruption without needing direct command execution capabilities.
This vulnerability aligns closely with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials in conjunction with improper context handling. In terms of the MITRE ATT&CK framework, it maps primarily to T1556 Credential Access via Modified Authentication Process or T1040 Network Sniffing if plain HTTP is exploited for interception, as well as T1223 Web Protocol Obfuscation when used in conjunction with other techniques. The exploitation relies heavily on social engineering elements where the user must initiate the subscription action, but once triggered, it automates credential theft and file system manipulation without further user interaction during routine calendar sync operations.
Mitigation for this issue requires immediate patching to Thunderbird version 159 or 153.6, which implement stricter validation logic to prevent subscriptions from resolving to non-expected domains or local paths unless explicitly authorized through secure mechanisms. Administrators should enforce the use of HTTPS for all calendar services and disable NTLM authentication where possible in favor of more modern protocols like Kerberos with mutual authentication or OAuth2. Additionally, users should be educated on verifying the source of any calendar subscription requests and avoiding interactions with untrusted network shares. Security monitoring tools should also be configured to detect unusual outbound connections from Thunderbird processes attempting to access internal IP ranges or known malicious domains during calendar synchronization events.