CVE-2026-113868

A flaw was found in Thunderbird. When authenticating to an email server using NT LAN Manager (NTLM) or Generic Security Services Application Program Interface (GSSAPI), the client fails to properly validate the server's authentication challenge format. A malicious server can exploit this flaw by sending a specially crafted challenge, causing Thunderbird to return uninitialized memory and leading to information disclosure. A malformed challenge can also trigger an out-of-bounds read that crashes the client, resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate severity rather than Important because successful exploitation is confined to the desktop user session and requires connecting to a hostile or intercepted mail server configured for specific authentication schemes. Under typical enterprise deployments, Thunderbird connects only to vetted corporate servers, and standard password authentication mechanisms are unaffected by this defect. In the event an adversary controls the upstream mail endpoint, the blast radius is restricted to reading uninitialized heap contents or causing the local client process to terminate unexpectedly.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.