CVE-2026-118180

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159

Description Thunderbird fails to validate the homeserver address received in the login response during Matrix account authentication. A compromised or malicious homeserver can provide a file: URL, redirecting subsequent session requests to local files. On Windows systems, this can be used to redirect requests to an attacker-controlled network share, leading to the leak of the user's NTLM (New Technology LAN Manager) credentials, which is a suite of security protocols used for authentication.

Recommendations Update to version 153.6. Update to version 159.