UBUNTU-CVE-2026-126134: Medium severity ubuntu/thunderbird vulnerability

Published Nov 12, 2026

Updated

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.

Affected Software

4 affected components

ubuntu/thunderbird*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 160
Upgrade
Upgrade Thunderbird to a version that resolves this vulnerability.
Fixed in 153.7

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are affected?

Only Thunderbird running on Windows is affected. Thunderbird on other operating systems is unaffected.

What must an attacker do to exploit this issue?

The attacker must trick a user into subscribing to a feed whose file: URL points to a network share controlled by the attacker. When Thunderbird fetches that feed, Windows may send the user's NTLM credentials to the attacker's server.

Which Thunderbird versions contain the fix?

The issue was fixed in Thunderbird 160 and Thunderbird 153.7.