8.1 High

CVE-2026-118176 Bypass of remote UNC path restriction in mailbox: URLs

Description

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Thunderbird 159	earliest → < 159	159
Thunderbird 153.6	earliest → < 153.6	153.6

References

bugzilla.mozilla.org bugzilla.mozilla.org
www.mozilla.org www.mozilla.org
www.mozilla.org www.mozilla.org

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 1713 CVEs of Thunderbird →

CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share 7.5 High CVE-2026-118179 Request forgery via news: links 8.8 High CVE-2026-118177 Calendar discovery accepted local file and remote network share locations 9.1 Critical CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share 5.7 Medium

Track this CVE