CVE-2026-118180None▾ SunlitWhen logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
ThunderbirdRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118178NoneRSS feed could redirect its subscription to a local file or network share
CVE-2026-118175NoneContent of other messages could be included when replying to a crafted message
CVE-2026-118174NoneDisplaying a message could load an attacker-chosen URL through an OpenPGP key attachment
CVE-2026-118177NoneCalendar discovery accepted local file and remote network share locations
CVE-2026-118176NoneBypass of remote UNC path restriction in mailbox: URLs
CVE-2026-118179NoneRequest forgery via news: links