CVE-2026-118180

A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.

The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected.

Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.