CVE-2026-118178 in Thunderbird
Summary
by MITRE • 10/27/2026
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The described vulnerability represents a significant security flaw within Mozilla Thunderbird, specifically affecting versions prior to 159 and 153.6 on the Windows operating system. The core issue stems from how the application handles RSS feed metadata updates through specific XML elements such as itunes:new-feed-url or newLocation. These elements are designed to allow feeds to dynamically update their source location without requiring manual user intervention. However, Thunderbird failed to adequately validate these URLs before applying them to its subscription management system. This lack of strict validation allowed a malicious RSS feed, or an attacker capable of modifying a feed delivered over unencrypted HTTP connections, to inject a file: URL scheme into the stored subscription data. Once this invalid and dangerous URL was saved as the active source for the feed, Thunderbird would subsequently attempt to access that location every time it performed a routine update check.
The operational impact of this flaw is severe due to its potential for information disclosure and credential theft. On Windows systems, when Thunderbird attempted to read from or connect to the injected file: URL, it triggered unintended local file system accesses. More critically, if the attacker-controlled location pointed towards a network share rather than a local file path, the application would initiate an authentication handshake with that remote server. This process inadvertently exposed the user's NTLM credentials in plaintext during the negotiation phase. Since NTLM hashes are susceptible to relay attacks and offline cracking, this leak poses a substantial risk to enterprise environments where these credentials may grant access to sensitive internal resources. While non-Windows platforms were not affected by the credential leakage aspect due to differences in how network authentication is handled or supported within the application's architecture on those systems, they remained vulnerable to local file reads, which could still lead to unauthorized disclosure of private user data stored on the disk.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials in conjunction with network authentication mechanisms that expose secrets. The attack vector leverages social engineering or supply chain compromise tactics where an attacker manipulates trusted content sources to execute unintended actions within the client application's context. In terms of MITRE ATT&CK, this behavior corresponds to T1059 Command and Scripting Interpreter if interpreted as a precursor to further exploitation, but more accurately maps to T1078 Valid Accounts for credential harvesting via NTLM relay or leakage scenarios. The vulnerability highlights the dangers of allowing dynamic updates from external sources without rigorous sanitization of URL schemes and destination types.
Mitigation strategies primarily involve upgrading Thunderbird to version 159 or later, which includes patches that enforce stricter validation rules on feed update URLs. Administrators should ensure that all instances of Thunderbird are updated across their infrastructure to prevent exposure. Additionally, users relying on RSS feeds should be advised to avoid subscribing to untrusted sources and to utilize encrypted connections such as HTTPS for any feed subscriptions where possible, thereby reducing the risk of man-in-the-middle modifications by attackers. Security monitoring tools can also be configured to detect unusual outbound NTLM authentication attempts originating from Thunderbird processes, providing an additional layer of defense against exploitation in environments where immediate patching is not feasible.