CVE-2026-113868: Vulnerability in Mozilla Thunderbird

CVE-2026-113868 describes a vulnerability in Mozilla Thunderbird's handling of NTLM authentication challenges when connecting to POP3 or SMTP servers. Thunderbird did not verify that the server's NTLM challenge was valid base64. A malicious server could exploit this by sending a malformed challenge, causing Thunderbird to include uninitialized heap memory in its NTLM response, thereby leaking potentially sensitive memory contents to the server. Additionally, a challenge consisting solely of base64 padding triggered an out-of-bounds read, crashing the client. This affects accounts configured for NTLM or GSSAPI authentication, but the memory disclosure is specific to NTLM. The issue was resolved in Thunderbird version 158.0.1.

An attacker controlling a POP3 or SMTP server could exploit this vulnerability to obtain uninitialized heap memory from the Thunderbird client during NTLM authentication, potentially disclosing sensitive information. Additionally, specially crafted challenges could crash Thunderbird, causing denial of service. The impact is limited to accounts using NTLM or GSSAPI authentication, with memory disclosure confined to NTLM only.

This vulnerability has been fixed in Mozilla Thunderbird version 158.0.1. Users and administrators should update affected Thunderbird installations to version 158.0.1 or later to remediate this issue. No additional mitigation steps are required once updated.