CVE-2026-118176

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.

This bug only affects Thunderbird on Windows. Other operating systems are unaffected.

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to enforce strict path canonicalization and reject extended-length UNC paths in Thunderbird mailbox: URL processing to prevent outbound SMB share access: upgrade to Thunderbird 159, Thunderbird 153.6 (or the fixed Thunderbird builds), which restrict extended-length UNC paths from being loaded via mailbox: URLs, closing extended-length UNC paths in mailbox: URLs. Until patched, this is only a concern on Thunderbird client installations running on Windows — Non-Windows operating systems (Linux, macOS) are unaffected — so Block outbound SMB traffic to untrusted or external networks at perimeter firewalls to prevent NTLM credential leaks, and caution users against opening suspicious emails on Windows endpoints. As a compensating measure, Deploy Windows Defender Application Control in enforced mode to block unauthorized binaries that might be executed if NTLM credentials are stolen in relay attacks, Confine application filesystem access strictly to local mail store directories to prevent mailbox: URLs from reaching remote UNC endpoints, and Enforce strict allowlist validation on local mailbox: URL syntax to reject unexpected extended-length UNC path patterns by default. These controls limit blast radius and contain exploitation, but they do not fix the underlying remote UNC path restriction bypass — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)