CVE-2026-118174

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159

Description Thunderbird automatically loads the content of OpenPGP key attachments to facilitate key importing. A sender can mark such an attachment as an external attachment pointing to an arbitrary URL, causing the application to load the URL without user interaction and bypassing remote content blocking. On Windows, if the URL points to an attacker-controlled network share, the user's NTLM credentials (a suite of security protocols used for authentication) can be leaked. On other operating systems, this allows an unauthorized remote request.

Recommendations Update to version 153.6. Update to version 159.