Unrated severityNVD Advisory· Published Nov 10, 2026

CVE-2026-126134

Description

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Mozilla Corporation/Thunderbirdllm-fuzzy
Range: <160

Patches

Vulnerability mechanics

References

bugzilla.mozilla.org/show_bug.cginvd
www.mozilla.org/security/advisories/mfsa2026-128/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000