UBUNTU-CVE-2026-126132: Medium severity ubuntu/thunderbird vulnerability
When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider. This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 160 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.7
Event History
Frequently Asked Questions
Which users and systems are exposed?
Only Thunderbird users on Linux and Windows are affected. Other operating systems are unaffected.
What user action is required for exploitation?
A specially crafted link attachment must be involved when a message is forwarded inline, edited as new, or when an attachment is dragged into a compose window. Saving or sending the message can replace the attachment with content from the referenced file or URL.
What information could be disclosed?
The issue could disclose local files or content reachable from the user's network. That content may be sent to message recipients or exposed to the user's mail provider.
Which Thunderbird releases contain the fix?
The vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.