Thunderbird 159 and 153.6 ESR fix Windows NTLM exposure and message leaks

Thunderbird’s October 27, 2026 desktop updates deserve attention if you have not installed them: 159.0 on the regular release channel and 153.6.0esr on ESR address security flaws that can expose message content or, on Windows, NTLM authentication data. Mozilla rates both security advisories high. These are existing October fixes, not a new November 5 release.

Can simply displaying an email trigger a connection?

For two documented flaws, yes. CVE-2026-118174 concerns an OpenPGP key attachment marked as external. Displaying the message could make Thunderbird fetch an attacker-selected URL to offer importing the key, bypassing remote-content blocking. Accepting the key was not required. On Windows, a network-share destination could leak NTLM credentials; on other operating systems, the described effect was an unwanted remote request.

CVE-2026-118176 is Windows-only. A crafted message could bypass the restriction on remote network-share paths in mailbox URLs and connect to an attacker-controlled SMB server. Mozilla describes disclosure of the Windows account name and NTLM authentication data, potentially usable for offline password cracking or relay attacks. That is not the same as proof that a clear-text password was stolen.

A separate flaw affects replies and forwards

CVE-2026-118175 could insert parts of another message in the same folder when replying to, forwarding or editing a crafted message as new, without a blocked-content warning. The disclosure occurred if the user sent that composition. The advisory does not say that merely receiving the email exposed the entire mailbox.

Calendars and RSS also need the fix

The advisories identify other paths with different prerequisites:

• CVE-2026-118177: calendar discovery during account setup or adding a network calendar could accept another server, a local file or a network share. A malicious server—or interference with a plain-HTTP lookup—could cause such a subscription. On Windows, refreshes could leak NTLM credentials; calendar edits could write to the attacker’s share or overwrite a local file.
• CVE-2026-118178: a malicious RSS feed, or an attacker modifying one delivered over HTTP, could persistently redirect the subscription to a local file or network share. This could cause local-file reads and, on Windows, NTLM exposure.

These are specific feature and platform conditions, not evidence that every Thunderbird installation has been compromised.

Which update should you install?

Use the supported update offered for your installed channel. The October 27 release notes identify 159.0 and 153.6.0esr; ESR users do not need to switch channels just to obtain these fixes. If a newer supported update is offered, use it rather than deliberately installing an older build. For a managed PC, follow your organisation’s deployment process.

The non-security changes also differ. Version 159.0 lists fixes for CardDAV password persistence, excessive Microsoft Graph requests, attachment forwarding and sent-folder copy recovery. The 153.6.0esr notes separately fix sent messages failing to save without warning. Do not assume every regular-channel change is included in ESR.

Mozilla cautions that many shared browser-engine flaws are not exploitable through ordinary email because scripting is disabled when reading mail. That caveat does not erase the mail-specific connection and disclosure scenarios above. The cited advisories do not establish active exploitation; this article reports the documented fixes, not a confirmed attack campaign.

Sources

• Thunderbird 159.0 release notes
• Thunderbird 153.6.0esr release notes
• Mozilla MFSA2026-121 — Thunderbird 159
• Mozilla MFSA2026-122 — Thunderbird 153.6d as external. Displaying the message could make Thunderbird fetch an attacker-selected URL to offer importing the key, bypassing remote-content blocking. Accepting the key was not required. On Windows, a network-share destination could leak NTLM credentials; on other operating systems, the described effect was an unwanted remote request.