CVE-2026-118179
Request forgery via news: links
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Request forgery via news: links
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
CVE-2026-118179- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-04
EUVDEUVD-2026-111356
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
EUVD-2026-111356- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-gm4x-83qc-5rx5
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without...
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
GHSA-gm4x-83qc-5rx5- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-04
NVD
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
CVE-2026-118179- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-118179
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
DEBIAN-CVE-2026-118179- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVUBUNTU-CVE-2026-118179
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Record
UBUNTU-CVE-2026-118179- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-06
OSVopenSUSE-SU-2026:12339-1 No score
MozillaThunderbird-153.6.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-153.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12339-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
thunderbirdDebian:12 |
before 1:153.6.0esr-1~deb12u2, plus listed versions 1:102.11.0-11:102.12.0-11:102.12.0-1~deb10u11:102.12.0-1~deb11u11:102.12.0-1~deb12u1 Show 45 moreShow less1:102.13.0-11:102.13.0-1~deb10u11:102.13.0-1~deb11u11:102.13.0-1~deb12u11:102.13.1-11:102.13.1-1~deb10u11:102.13.1-1~deb11u11:102.13.1-1~deb12u11:102.14.0-1~deb10u11:102.14.0-1~deb11u11:102.14.0-1~deb12u11:102.15.0-1~deb10u11:102.15.0-1~deb11u11:102.15.0-1~deb12u11:102.15.1-1~deb10u11:102.15.1-1~deb11u11:102.15.1-1~deb12u11:103.0~b5-11:104.0~b2-11:110.0~b4-11:112.0~b1-11:113.0~b3-11:114.0~b2-11:115.0-11:115.0.1-11:115.0.1-21:115.0~b4-11:115.0~b6-11:115.1.0-11:115.1.1-11:115.10.1-11:115.10.1-1~deb10u11:115.10.1-1~deb11u11:115.10.1-1~deb12u11:115.11.0-11:115.11.0-1~deb10u11:115.11.0-1~deb11u11:115.11.0-1~deb12u11:115.12.0-11:115.12.0-1~deb10u11:115.12.0-1~deb11u11:115.12.0-1~deb12u11:115.13.0-11:115.13.0-1~deb11u11:115.13.0-1~deb12u1 |
1:153.6.0esr-1~deb12u2 |
thunderbirdDebian:13 |
before 1:153.6.0esr-1~deb13u1, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1 |
1:153.6.0esr-1~deb13u1 |
thunderbirdDebian:14 |
All versions, plus listed versions 1:128.13.0esr-11:128.14.0esr-11:128.14.0esr-1~deb11u11:128.14.0esr-1~deb12u11:128.14.0esr-1~deb13u1 Show 45 moreShow less1:129.0~b6-11:130.0~b3-11:132.0~b6-11:135.0-11:136.0-11:137.0-11:138.0-11:140.0.1esr-11:140.1.0esr-11:140.1.1esr-11:140.10.0esr-11:140.10.0esr-1~deb11u11:140.10.0esr-1~deb12u11:140.10.0esr-1~deb13u11:140.10.1esr-11:140.10.1esr-1~deb11u11:140.10.1esr-1~deb12u11:140.10.1esr-1~deb13u11:140.10.2esr-11:140.10.2esr-1~deb11u11:140.10.2esr-1~deb12u11:140.10.2esr-1~deb13u11:140.11.0esr-11:140.11.0esr-1~deb11u11:140.11.0esr-1~deb12u11:140.11.0esr-1~deb13u11:140.12.0esr-11:140.12.0esr-1~deb11u11:140.12.0esr-1~deb12u11:140.12.0esr-1~deb13u11:140.13.0esr-11:140.13.0esr-21:140.13.0esr-2~deb11u11:140.13.0esr-2~deb12u11:140.13.0esr-2~deb13u11:140.14.0esr-11:140.14.0esr-1~deb11u11:140.14.0esr-1~deb12u11:140.14.0esr-1~deb13u11:140.15.0esr-1~deb12u11:140.15.0esr-1~deb13u11:140.16.0esr-1~deb12u11:140.16.0esr-1~deb13u11:140.17.0esr-1~deb12u11:140.17.0esr-1~deb13u1 |
None known |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs102Ubuntu:22.04:LTS |
All versions, plus listed versions 102.11.0-0ubuntu0.22.04.1102.12.0-0ubuntu0.22.04.1102.13.0-0ubuntu0.22.04.1102.15.1-0ubuntu0.22.04.1 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
thunderbirdUbuntu:22.04:LTS |
All versions, plus listed versions 1:91.1.2+build1-0ubuntu11:91.3.0+build2-0ubuntu11:91.3.1+build1-0ubuntu11:91.3.2+build1-0ubuntu11:91.4.0+build1.1-0ubuntu1 Show 34 moreShow less1:91.4.0+build2-0ubuntu11:91.5.0+build1-0ubuntu11:91.5.1+build1-0ubuntu11:91.6.1+build1-0ubuntu11:91.7.0+build1-0ubuntu11:91.7.0+build2-0ubuntu11:91.8.0+build2-0ubuntu11:91.9.1+build1-0ubuntu0.22.04.11:91.11.0+build2-0ubuntu0.22.04.11:102.2.2+build1-0ubuntu0.22.04.11:102.4.2+build2-0ubuntu0.22.04.11:102.7.1+build2-0ubuntu0.22.04.11:102.8.0+build2-0ubuntu0.22.04.11:102.9.0+build1-0ubuntu0.22.04.11:102.10.0+build2-0ubuntu0.22.04.11:102.11.0+build1-0ubuntu0.22.04.11:102.13.0+build1-0ubuntu0.22.04.11:102.15.0+build1-0ubuntu0.22.04.11:102.15.1+build1-0ubuntu0.22.04.11:115.3.1+build1-0ubuntu0.22.04.21:115.4.1+build1-0ubuntu0.22.04.11:115.5.0+build1-0ubuntu0.22.04.11:115.6.0+build2-0ubuntu0.22.04.11:115.8.1+build1-0ubuntu0.22.04.11:115.9.0+build1-0ubuntu0.22.04.11:115.10.1+build1-0ubuntu0.22.04.11:115.11.0+build2-0ubuntu0.22.04.11:115.12.0+build3-0ubuntu0.22.04.11:115.13.0+build5-0ubuntu0.22.04.11:115.15.0+build1-0ubuntu0.22.04.11:115.16.0+build2-0ubuntu0.22.04.11:115.18.0+build1-0ubuntu0.22.04.11:128.12.0+build1-0ubuntu0.22.04.11:140.7.1+build1-0ubuntu0.22.04.1 |
None known |
mozjs102Ubuntu:24.04:LTS |
All versions, plus listed versions 102.15.1-1102.15.1-3ubuntu2 |
None known |
mozjs115Ubuntu:24.04:LTS |
All versions, plus listed versions 115.3.0-0ubuntu1115.4.0-2115.5.0-1115.6.0-1115.7.0-4 Show 4 moreShow less115.8.0-1115.9.0-1115.9.0-1build1115.10.0-1 |
None known |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 153 CVEs |
before 153.6.0-1.1 | 153.6.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, GitHub Advisories, NVD, OSV | |
| cwes, facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118179 is a high vulnerability (CVSS 8.8) in Mozilla Thunderbird, published October 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in thunderbird 1:153.6.0esr-1~deb12u2.
References
bugzilla.mozilla.org/show_bug.cgi?id=2077789
mozilla.org/security/advisories/mfsa2026-121
nvd.nist.gov/vuln/detail/CVE-2026-118179
github.com/advisories/GHSA-gm4x-83qc-5rx5
security-tracker.debian.org/tracker/CVE-2026-118179
Show 156 moreShow less
ubuntu.com/security/CVE-2026-118179
cve.org/CVERecord?id=CVE-2026-118179
suse.com/security/cve/CVE-2026-110247
Left out here: 321 versions. The JSON record has them.