A vulnerability in Thunderbird allows a remote RSS feed to use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a local file URL. This causes Thunderbird to read local files on every feed update. On Windows, this can also cause Thunderbird to connect to an attacker-controlled network share, potentially leaking the user's NTLM credentials. The issue affects all platforms for local file reads, but the NTLM credential leak is specific to Windows. This vulnerability was fixed in Thunderbird versions 159 and 153.6.