CVE-2026-126134

NameCVE-2026-126134
DescriptionThunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
thunderbird (PTS)bookworm1:140.12.0esr-1~deb12u1vulnerable
bookworm (security)1:153.6.0esr-1~deb12u2vulnerable
trixie1:140.12.0esr-1~deb13u1vulnerable
trixie (security)1:153.6.0esr-1~deb13u1vulnerable
forky1:153.5.0esr-1vulnerable
sid1:153.7.0esr-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
thunderbirdsource(unstable)1:153.7.0esr-1

Notes

https://www.mozilla.org/en-US/security/advisories/mfsa2026-129/#CVE-2026-126134
Search for package or bug name: Reporting problems