CVE-2026-118174 is a vulnerability in Mozilla Thunderbird
Published on October 27, 2026
Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Vulnerability Analysis
CVE-2026-118174 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Inclusion of Functionality from Untrusted Control Sphere
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
Products Associated with CVE-2026-118174
Want to know whenever a new CVE is published for Mozilla Thunderbird? stack.watch will email you.
Affected Versions
Mozilla Thunderbird:- Version 153.6, <= 153.* is unaffected.
- Version 159, <= * is unaffected.