CVE-2026-126132

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.7 Thunderbird versions prior to 160

Description Thunderbird on Linux and Windows contains a flaw where specially crafted link attachments, such as .desktop files on Linux or .url and .lnk files on Windows, are replaced with the actual content of the file or URL they point to. This occurs when a message is forwarded inline, edited as new, or when an attachment is dragged into a compose window and subsequently saved or sent. This behavior can lead to the disclosure of local files or content from the user's network to the mail provider or the message recipients.

Recommendations Update to version 153.7. Update to version 160.