CVE-2026-113868

Received Received - Intake

NTLM Authentication Memory Disclosure in Thunderbird

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Mozilla Corporation

Description

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only affected NTLM. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-20

Generated

2026-10-21

AI Q&A

2026-10-21

EPSS Evaluated

N/A

NVD

CVE-2026-113868

EUVD

EUVD-2026-105295

Affected Vendors & Products

Vendor	Product	Version / Range
mozilla	thunderbird	158.0.1
mozilla	thunderbird	153.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not validate if the server's challenge was valid base64. A malicious server could send a challenge causing Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory. A challenge with only base64 padding also caused an out-of-bounds read, crashing Thunderbird.

Detection Guidance

Detection involves checking if Thunderbird is running an affected version (prior to 158.0.1 or 153.5.1) and if NTLM or GSSAPI authentication is configured. Inspect Thunderbird version with 'thunderbird --version' and review account settings for NTLM/GSSAPI usage.

Impact Analysis

This vulnerability could allow a malicious server to read uninitialized memory from Thunderbird during NTLM authentication, potentially exposing sensitive data. It could also crash Thunderbird if the server sends a malformed base64 challenge.

Mitigation Strategies

Update Thunderbird to version 158.0.1 or 153.5.1 or later immediately. Disable NTLM or GSSAPI authentication in account settings if not required. Monitor for crashes or unusual memory usage during authentication attempts.

Hi! I’m here to help you understand CVE-2026-113868. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70