CVE-2026-118176None▾ SunlitThunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB se…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
ThunderbirdRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118178NoneRSS feed could redirect its subscription to a local file or network share
CVE-2026-118175NoneContent of other messages could be included when replying to a crafted message
CVE-2026-118174NoneDisplaying a message could load an attacker-chosen URL through an OpenPGP key attachment
CVE-2026-118177NoneCalendar discovery accepted local file and remote network share locations
CVE-2026-118180NoneMatrix homeserver could redirect the chat session to a local file or network share
CVE-2026-118179NoneRequest forgery via news: links