CVE-2026-126134

EUVD-2026-122688
Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mozillaCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
mozillathunderbird
𝑥
< 160
CNA
mozillathunderbird_esr
𝑥
< 153.7
CNA
References
https://bugzilla.mozilla.org/show_bug.cgi?id=2083584
https://www.mozilla.org/security/advisories/mfsa2026-128/
https://www.mozilla.org/security/advisories/mfsa2026-129/