Summary
- Thunderbird 159 fixes Windows-specific NTLM credential exposure paths.
- A separate issue could include text from another stored message in an outgoing reply.
- Mozilla distinguishes email-reachable flaws from browser-engine issues mitigated by disabled message scripting.
Mozilla Thunderbird has issued version 159 to address several email-specific security vulnerabilities, including weaknesses that could reveal Windows authentication information and one that could place content from a different stored message into an outgoing reply.
The 27 October security advisory assigns high-impact ratings to problems involving OpenPGP attachments, crafted mailbox paths and reply content handling. These findings sit alongside fixes inherited from browser-related components, although Mozilla cautions that many browser-engine flaws cannot be exploited through ordinary email because scripting is disabled when messages are read.
One issue, CVE-2026-118174, involved Thunderbird automatically processing the contents of an OpenPGP key attachment in order to offer an import option. A specially formed external attachment could direct the client to load an arbitrary remote location without the expected remote-content restrictions. On Windows, a destination on an attacker-controlled network share could lead to NTLM authentication data being disclosed.
Windows authentication exposure
A separate vulnerability, CVE-2026-118176, involved restrictions on mailbox URLs that were intended to block access to remote Windows network shares. Mozilla says extended-length UNC paths could bypass those restrictions, allowing a crafted email to cause a connection to a remote SMB service controlled by an attacker.
Such a connection may disclose a Windows account name and NTLM authentication material. That material can potentially be used in offline password attacks or relay scenarios, depending on environmental protections and the way the credentials are handled. It does not mean the message directly contains a user’s plaintext password.
Mozilla states that the NTLM leakage described in these two cases is specific to Thunderbird on Windows. On other operating systems, the OpenPGP issue could still lead to an unexpected remote request, but the Windows authentication consequence does not apply in the same form.
This platform distinction matters in mixed fleets. Email clients can look identical from a user’s perspective while operating-system authentication mechanisms lead to different impacts. Vulnerability inventories need to include operating system and application configuration, not just the shared Thunderbird version number.
A different route to information disclosure
CVE-2026-118175 concerns the handling of a crafted email when a recipient replies, forwards it or edits it as a new message. Under the affected conditions, Thunderbird could incorporate pieces of a different message stored in the same folder into the draft. If the user then sent the result, information from the unrelated message could be disclosed to the recipients.
This weakness does not require an attacker to obtain direct access to the other message’s mailbox record. Instead, it involves a client-side composition error that can mix content which should remain separate. Its practical consequence depends on whether the manipulated draft is ultimately sent; Mozilla does not claim every viewing of a crafted message results in disclosure.
Additional corrected issues concern feed handling, messaging protocols and Matrix chat integration. The advisory describes different preconditions for each, including cases requiring a particular account configuration or an attacker-controlled server. Treating the entire update as one generic remote-code-execution flaw would obscure those conditions.
Thunderbird’s security model has several layers: message rendering restrictions, remote-content blocking, protocol handling, file access and the operating system’s own credential protections. The new defects cross different boundaries, and the fixes address them in distinct components.
An organisation using Thunderbird for correspondence involving contracts, personal data or sensitive internal decisions has a particular interest in composition integrity. A flaw that can mix messages undermines the assumption that an outgoing draft contains only the information the sender selected, even if no external mailbox account has been compromised.
Mozilla has not reported active exploitation of these Thunderbird 159 issues. Its advisory specifies that Windows NTLM disclosure depends on particular remote-resource conditions, while the cross-message content flaw requires an affected draft to be sent before its unintended contents reach recipients.
