CVE-2026-113868
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not validate that the server's challenge was valid base64. A malicious server could send a challenge causing Thunderbird to include uninitialized heap memory in its NTLM response, disclosing it to the server; a challenge consisting only of base64 padding caused an out-of-bounds read and crash.
Risk Assessment
A malicious or compromised mail server could obtain fragments of Thunderbird's process memory, potentially exposing sensitive data. It could also crash the mail client.
Recommendation
Update Thunderbird to version 158.0.1 or 153.5.1 (or later). Consider avoiding NTLM/GSSAPI authentication to untrusted servers.
Other vulnerabilities in Thunderbird
See all- CVE-2026-113867Critical
Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This bug only affects Thunderbird's chat feature with XMPP accounts and was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
- CVE-2026-92240Critical
A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication.
- CVE-2026-92238Critical
A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
- CVE-2026-84639Critical
Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84637Critical
Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2.
- CVE-2026-84143Critical
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
- CVE-2026-84142Critical
Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155.
- CVE-2026-16361Critical
Memory safety bugs in Thunderbird ESR 140.12 that could allow arbitrary code execution. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
- CVE-2026-16360Critical
Memory safety bugs were found in Thunderbird ESR 140.12 and Thunderbird 152, some of which showed evidence of memory corruption. With enough effort, some of these could potentially be exploited to run arbitrary code. The vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
- CVE-2026-118180Low risk· EPSS 7%
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
Original NVD description (English source)
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS