7.5 High

CVE-2026-118175 Content of other messages could be included when replying to a crafted message

Description

When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Thunderbird 159	earliest → < 159	159
Thunderbird 153.6	earliest → < 153.6	153.6

References

bugzilla.mozilla.org bugzilla.mozilla.org
www.mozilla.org www.mozilla.org
www.mozilla.org www.mozilla.org

Timeline

Published October 27, 2026
Last modified November 4, 2026

The 1713 CVEs of Thunderbird →

CVE-2026-118180 Matrix homeserver could redirect the chat session to a local file or network share 7.5 High CVE-2026-118179 Request forgery via news: links 8.8 High CVE-2026-118177 Calendar discovery accepted local file and remote network share locations 9.1 Critical CVE-2026-118178 RSS feed could redirect its subscription to a local file or network share 5.7 Medium

Track this CVE