DEBIAN-CVE-2026-126134: Debian/thunderbird vulnerability
Published Nov 10, 2026
·Updated
Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Affected Software
3 affected components
debian/thunderbird*
debian/thunderbird*
debian/thunderbird*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbird on Windowsto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbird on Windowsto a version that resolves this vulnerability.Fixed in 153.7
Event History
Nov 10, 2026
CVE Published
via OSV·07:21 PM
Data Sourced
via OSV·07:21 PM
DescriptionAffected Software