CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

Q: Which Thunderbird accounts are exposed?

Accounts configured to authenticate to POP3 or SMTP servers using NTLM or GSSAPI are affected. The uninitialized heap-memory disclosure is limited to NTLM; the padding-only challenge crash can affect the stated NTLM or GSSAPI configurations.

Q: What does an attacker need to exploit this issue?

The attacker needs to operate or control a POP3 or SMTP server that the affected Thunderbird client authenticates to. Exploitation occurs through a malformed server authentication challenge, without user interaction.

Q: Are accounts using authentication methods other than NTLM or GSSAPI affected?

The provided information identifies only POP3 or SMTP accounts configured for NTLM or GSSAPI authentication as affected. It does not identify other authentication methods as affected.

Q: What versions contain the fix?

The issue was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Published Oct 20, 2026

Updated

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM.

Affected Software

3 affected componentsFixes available

Mozilla Thunderbird<158.0.1

Mozilla Thunderbird<153.5.1

153.5.1

Mozilla Thunderbird<158.0.1

158.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 158.0.1
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.5.1

Event History

Oct 20, 2026

CVE Published

via Mozilla·12:00 AM

Data Sourced

via Mozilla·12:00 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

Description

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

Which Thunderbird accounts are exposed?

Accounts configured to authenticate to POP3 or SMTP servers using NTLM or GSSAPI are affected. The uninitialized heap-memory disclosure is limited to NTLM; the padding-only challenge crash can affect the stated NTLM or GSSAPI configurations.

What does an attacker need to exploit this issue?

The attacker needs to operate or control a POP3 or SMTP server that the affected Thunderbird client authenticates to. Exploitation occurs through a malformed server authentication challenge, without user interaction.

Are accounts using authentication methods other than NTLM or GSSAPI affected?

The provided information identifies only POP3 or SMTP accounts configured for NTLM or GSSAPI authentication as affected. It does not identify other authentication methods as affected.

What versions contain the fix?

The issue was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

Which Thunderbird accounts are exposed?

What does an attacker need to exploit this issue?

Are accounts using authentication methods other than NTLM or GSSAPI affected?

What versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which Thunderbird accounts are exposed?

What does an attacker need to exploit this issue?

Are accounts using authentication methods other than NTLM or GSSAPI affected?

What versions contain the fix?