Mozilla shipped desktop fixes on 27 October 2026: Thunderbird 159.0 (release) and 153.6.0esr (ESR). Security advisories MFSA2026-121 and MFSA2026-122 are rated high. Sourced recap: Thunderbird 159 / 153.6 ESR — NTLM and message leaks.
Confirmed scope
- Displaying certain messages (external OpenPGP key, mailbox paths) can trigger an unwanted connection; on Windows, that may expose NTLM authentication data (not proof of a stolen clear-text password).
- In one documented case, replying, forwarding or editing a crafted message could insert fragments of another message in the same folder — disclosure was tied to sending that composition.
- Separate paths cover calendar discovery and RSS (HTTP / network shares), each with precise prerequisites.
- These are October fixes, not a new 5–6 November release. ESR users should take 153.6.0esr (or newer offered) without switching channels just for optics.
Out of scope
- The cited advisories do not establish active exploitation.
- Shared browser-engine flaws are not automatically exploitable via ordinary email (scripting disabled when reading mail) — that caveat does not erase the mail/NTLM scenarios above.
Sources
- Thunderbird 159.0 release notes
- Thunderbird 153.6.0esr release notes
- MFSA2026-121
- MFSA2026-122
- TricknFix article
Question: on your Windows PC, does Help → About already show 159.x or 153.6.x esr (or newer), and do you still use plain-HTTP calendars/RSS or network shares inside Thunderbird?