CVE-2026-118179None▾ SunlitClicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the se…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
ThunderbirdRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118178NoneRSS feed could redirect its subscription to a local file or network share
CVE-2026-118175NoneContent of other messages could be included when replying to a crafted message
CVE-2026-118174NoneDisplaying a message could load an attacker-chosen URL through an OpenPGP key attachment
CVE-2026-118177NoneCalendar discovery accepted local file and remote network share locations
CVE-2026-118180NoneMatrix homeserver could redirect the chat session to a local file or network share
CVE-2026-118176NoneBypass of remote UNC path restriction in mailbox: URLs