CVE-2026-118179 in Thunderbird
Summary
by MITRE • 10/27/2026
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability represents a critical failure in input validation and protocol handling within Mozilla Thunderbird, specifically affecting the processing of news-related URI schemes including news: and snews:. The core technical flaw lies in how the application parses message-IDs embedded within these links. When a user clicks such a link, Thunderbird initiates an immediate connection to the host and port specified in the Uniform Resource Identifier without performing any prior validation against configured server settings or prompting for user consent. This behavior bypasses standard security controls that typically restrict outbound connections to explicitly trusted destinations, effectively allowing arbitrary network interactions based solely on content embedded within email messages or news articles.
A particularly dangerous aspect of this vulnerability is the handling of line breaks within the message-ID field. The application fails to sanitize these characters before transmitting them to the target server. In protocols like NNTP (Network News Transfer Protocol), which operates over TCP, newlines are significant delimiters that separate commands and their arguments. By sending unmodified line breaks, a malicious actor can craft a single URI link that contains multiple distinct protocol commands. This allows for command injection attacks where an attacker can send arbitrary instructions to any service reachable from the user's network segment. For instance, if an internal server such as a database management system or administrative interface listens on port 119 and accepts NNTP-like syntax, it could be exploited through this vector.
The security implications are severe due to the potential for unauthorized access and data exfiltration within private networks. Since Thunderbird connects without verifying that the target is a configured news server, an attacker can redirect traffic to internal infrastructure services that may not have public-facing authentication mechanisms or firewalls protecting them from client-side attacks originating from email clients. Furthermore, when using snews: links which are intended for secure connections via TLS, the vulnerability allows connections to proceed without establishing encryption if the target does not support it or if the implementation fails to enforce security requirements. This lack of mandatory TLS enforcement exposes sensitive data in transit and facilitates man-in-the-middle attacks against internal services that might otherwise be considered safe from external threats due to network segmentation.
This issue aligns with CWE-20 Improper Input Validation, as the application does not adequately sanitize special characters like newlines within user-controlled input derived from email content. It also relates to CWE-918 Server-Side Request Forgery (SSRF) because it enables an attacker to induce the client application to make requests to arbitrary internal resources that are otherwise inaccessible directly by the attacker. From a threat modeling perspective, this behavior corresponds to ATT&CK technique T1560.002 Archive Collected Data via Compressed Archives if used in conjunction with data staging, but more accurately reflects lateral movement and reconnaissance capabilities enabled by SSRF-like behaviors where an email client acts as a proxy for network interaction.
Mitigation strategies primarily involve applying the vendor-provided patches released in Thunderbird versions 159 and 153.6 which address these parsing flaws. Administrators should ensure that all instances of Thunderbird are updated to these patched versions immediately. In environments where immediate patching is not feasible, network-level controls such as firewall rules can be implemented to restrict outbound connections from the email client process on port 119 and related NNTP ports to only known internal news servers. Additionally, users should exercise caution when interacting with links in emails or news feeds that reference unusual protocols or unexpected hosts until the software is fully updated.