CVE-2026-118180

UNKNOWN 0.0

Matrix homeserver could redirect the chat session to a local file or network share

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

Vendor	mozilla
Product	thunderbird
Ecosystems	Browser JavaScript
Industries	Technology
Published	Oct 27, 2026
Last Updated	Oct 27, 2026

Stay Ahead of the Next One

Get instant alerts for mozilla thunderbird

Be the first to know when new unknown vulnerabilities affecting mozilla thunderbird are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Mozilla / Thunderbird

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

bugzilla.mozilla.org: https://bugzilla.mozilla.org/show_bug.cgi?id=2080939 mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-121/ mozilla.org: https://www.mozilla.org/security/advisories/mfsa2026-122/

Credits

Magnus Melin