CVE-2026-118177VulnerabilityPublished 27 Oct 2026

When Looking for Calendars

Source GCVE Database

Authoritative record:CVE-2026-118177· High

Not known to be exploited · fixed in 153.6 : patch Thunderbird soon.

Data as of 27 Oct 2026, 22:14 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Patch: Available – fixed in 153.6

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-7w88-6r56-g2q9

What to do

AI-suggested

This vulnerability is fixed in Thunderbird versions 159 and 153.6. Users and administrators should update to these versions or later to remediate the issue. No additional mitigation is required once updated.

Description

Thunderbird versions prior to 159 and 153.6 accepted calendar locations from directory lookups that could point to local files or remote network shares. This flaw allowed a malicious server or network attacker to cause Thunderbird to subscribe to such locations, potentially leaking Windows NTLM credentials on every calendar refresh and enabling unauthorized writes to local or remote files.

Impact

On Windows systems, this vulnerability can leak the user's NTLM credentials to an attacker-controlled host during calendar refreshes. Additionally, the attacker may write changes to the calendar on their network share or overwrite local files, potentially leading to unauthorized data modification. The impact is high due to credential exposure and potential data integrity compromise.

Summary

CVE-2026-118177 describes a vulnerability in Thunderbird's calendar discovery process where, during account setup or adding a network calendar, the client accepted calendar locations pointing to other servers, local files, or network shares. An attacker controlling the server or intercepting HTTP traffic could exploit this to make Thunderbird subscribe to attacker-controlled locations. On Windows, this leads to NTLM credential leakage to the attacker on each calendar refresh and allows the attacker to write changes to their share or overwrite local files. This issue was fixed in Thunderbird versions 159 and 153.6.

References

Community reviews

Loading reviews…