DEBIAN-CVE-2026-118179: Debian/thunderbird vulnerability

Published Oct 27, 2026

Updated

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Affected Software

3 affected components

debian/thunderbird*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 159
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.6

Event History

Oct 27, 2026

CVE Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to exploitation?

Users who click a crafted news: or snews: link are exposed if the referenced host and port are reachable from their network. The target does not need to be configured as a news server in Thunderbird.

What does an attacker need to exploit this issue?

An attacker needs to persuade a user to click a news: or snews: link containing a message-ID with line breaks. Those line breaks can be transmitted unmodified to the target service as arbitrary commands.

Are secure news links protected by TLS?

No. For snews: links pointing to these unconfigured servers, Thunderbird connected without TLS.

Which Thunderbird releases contain the fix?

The issue was fixed in Thunderbird 159 and Thunderbird 153.6.

DEBIAN-CVE-2026-118179: Debian/thunderbird vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

Are secure news links protected by TLS?

Which Thunderbird releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to exploit this issue?

Are secure news links protected by TLS?

Which Thunderbird releases contain the fix?