CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 158.0.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 153.5.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:153.6.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.6.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 158.0.1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.5.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Which Thunderbird accounts are exposed?
Accounts configured to authenticate to POP3 or SMTP servers using NTLM or GSSAPI are affected. The uninitialized heap-memory disclosure is limited to NTLM; the padding-only challenge crash can affect the stated NTLM or GSSAPI configurations.
What does an attacker need to exploit this issue?
The attacker needs to operate or control a POP3 or SMTP server that the affected Thunderbird client authenticates to. Exploitation occurs through a malformed server authentication challenge, without user interaction.
Are accounts using authentication methods other than NTLM or GSSAPI affected?
The provided information identifies only POP3 or SMTP accounts configured for NTLM or GSSAPI authentication as affected. It does not identify other authentication methods as affected.
What versions contain the fix?
The issue was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.