CVE-2026-118177

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159

Description Thunderbird accepts calendar locations pointing to external servers, local files, or network shares during account setup or when adding a new network calendar. A malicious server or a network attacker using plain HTTP can force the application to subscribe to these locations. On Windows, this can lead to the leakage of NTLM credentials to an attacker-controlled host during calendar refreshes. Additionally, calendar changes may be written to an attacker's share or used to overwrite local files.

Recommendations Update to version 153.6. Update to version 159.