Mozilla Thunderbird up to 158.0.0 NTLM Authentication out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in Mozilla Thunderbird up to 158.0.0. This issue affects some unknown processing of the component NTLM Authentication. The manipulation results in out-of-bounds. This vulnerability is identified as CVE-2026-113868. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Mozilla Thunderbird up to 158.0.0. Affected is an unknown functionality of the component NTLM Authentication. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1.

The advisory is shared for download at bugzilla.mozilla.org. This vulnerability is traded as CVE-2026-113868 since 10/20/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/20/2026).

Upgrading to version 158.0.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Mail Client Software

Vendor

• Mozilla

Name

• Thunderbird

Version

• 158.0

License

• open-source

Website

• Vendor: https://www.mozilla.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion