Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-126134

Feed subscriptions could leak NTLM credentials on Windows

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mozilla

Description

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Thunderbird

  • 153.7 to ≤ 153.*unaffected
  • 160 to ≤ *unaffected

References