DEBIAN-CVE-2026-118175: Debian/thunderbird vulnerability

Published Oct 27, 2026

Updated

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Affected Software

3 affected components

debian/thunderbird*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.6

Event History

Oct 27, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Frequently Asked Questions

What user action is required for disclosure to occur?

A user must reply to, forward, or edit a crafted email as a new message and then send the resulting message. The disclosure occurs when content from another message in the same folder is embedded in the composed message and sent to its recipients.

Which Thunderbird versions contain the fix?

The issue was fixed in Thunderbird 159 and Thunderbird 153.6.

DEBIAN-CVE-2026-118175: Debian/thunderbird vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What user action is required for disclosure to occur?

Which Thunderbird versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

What user action is required for disclosure to occur?

Which Thunderbird versions contain the fix?