Mozilla Foundation Security Advisory 2026-128

Security Vulnerabilities fixed in Thunderbird 160

Announced

November 10, 2026

Impact

high

Products

Thunderbird

Fixed in

Thunderbird 160

Many of these flaws cannot be exploited through email in the Thunderbird product because scripting is disabled when reading mail, however they may pose risks in browser or browser-like contexts.

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-126132: Attachments could be replaced with local file content when forwarding

Reporter: Christopher Bohn (Protectstar Inc.)
Impact: high

Description

When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider.

This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected.

References

Bug 2081919

#CVE-2026-126133: Calendar server credentials could be sent to an HTTP proxy

Reporter: Christopher Bohn (Protectstar Inc.)
Impact: moderate

Description

When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS.

References

Bug 2083485

#CVE-2026-126134: Feed subscriptions could leak NTLM credentials on Windows

Reporter: Magnus Melin
Impact: moderate

Description

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server.

This bug only affects Thunderbird on Windows. Other operating systems are unaffected.

References

Bug 2083584

#CVE-2026-126135: SMTP and POP3 response injection when using STARTTLS

Reporter: Ibrahim Alghamdi
Impact: moderate

Description

If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected.

References

Bug 2085343

#CVE-2026-126136: OAuth2 access token could be sent over an unencrypted connection with Exchange accounts

Reporter: Álvaro Chico Martínez
Impact: moderate

Description

For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured.

Firefox browsers

Mozilla VPN

Mozilla Monitor

Firefox Relay

MDN Plus

Thunderbird

0DIN

Tabstack

Otari

About Mozilla

The Mozilla Manifesto

Get Involved

Blog