CVE-2026-113868: Thunderbird NTLM Information Disclosure

CVE-2026-113868 Overview

CVE-2026-113868 affects Mozilla Thunderbird when authenticating to POP3 or SMTP servers using NTLM. Thunderbird failed to validate whether the server's challenge was valid base64 before processing it. A malicious server can exploit this flaw to force Thunderbird to include uninitialized heap memory in its NTLM response, leaking that memory back to the server. A specially crafted challenge containing only base64 padding triggers an out-of-bounds read that crashes the client. The flaw affects accounts configured for NTLM or GSSAPI authentication, though the memory disclosure component only affects NTLM. Mozilla fixed the issue in Thunderbird 158.0.1 and Thunderbird 153.5.1.

Critical Impact

A malicious or compromised mail server can crash the Thunderbird client and read portions of its uninitialized heap memory, potentially exposing sensitive data processed by the application.

Affected Products

• Mozilla Thunderbird versions prior to 153.5.1
• Mozilla Thunderbird versions prior to 158.0.1
• Thunderbird accounts configured with NTLM or GSSAPI authentication for POP3 or SMTP

Discovery Timeline

• 2026-10-20 - CVE-2026-113868 published to NVD
• 2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113868

Vulnerability Analysis

The vulnerability resides in Thunderbird's NTLM authentication handler for POP3 and SMTP protocols. During the NTLM challenge-response exchange, the server sends a base64-encoded Type 2 message containing a challenge nonce. Thunderbird decodes this challenge and incorporates portions of it into its Type 3 response. The client fails to verify that the received challenge is syntactically valid base64 before decoding and processing it.

When the server returns a malformed challenge, the decoder produces a buffer with uninitialized bytes. Thunderbird then transmits those bytes back to the server as part of the authentication response. This leaks arbitrary heap contents to the attacker-controlled server. A degenerate challenge consisting entirely of base64 padding characters triggers an additional out-of-bounds read that terminates the process. The weakness is classified as an out-of-bounds read [CWE-125].

Root Cause

The root cause is missing input validation on untrusted server-supplied data. The NTLM challenge handler assumes the server's challenge is well-formed base64 and sized appropriately. No length check or format validation is performed before memory operations run on the decoded buffer. This allows crafted challenges to drive reads past valid buffer bounds and to leave bytes in the response buffer uninitialized.

Attack Vector

Exploitation requires the victim to connect to a mail server controlled or impersonated by the attacker. The attacker must configure the target Thunderbird account to use NTLM or GSSAPI authentication for POP3 or SMTP. Network-adjacent adversaries capable of intercepting or redirecting mail traffic, or operators of rogue mail servers, can trigger the issue. Once the client issues an authentication request, the malicious server replies with a crafted base64 challenge to either harvest leaked heap memory or crash the client.

No verified exploit code is publicly available. Technical specifics are documented in Mozilla Bug #2076569 and the related advisories MFSA-2026-114 and MFSA-2026-115.

Detection Methods for CVE-2026-113868

Indicators of Compromise

• Repeated or unexpected Thunderbird process crashes immediately after mail account authentication attempts.
• POP3 or SMTP sessions where the server-supplied NTLM Type 2 challenge contains invalid base64 characters or consists solely of = padding.
• Outbound NTLM Type 3 responses with anomalously structured payload fields when compared to normal client traffic.
• Mail client connections to unexpected or newly observed SMTP/POP3 endpoints that negotiate NTLM authentication.

Detection Strategies

• Inspect SMTP and POP3 traffic for AUTH NTLM exchanges where the server challenge decodes to malformed data.
• Correlate Thunderbird application crash telemetry with recent mail server authentication events.
• Alert on mail client processes connecting to domains or IP addresses outside the organization's approved mail infrastructure.

Monitoring Recommendations

• Collect Thunderbird crash reports and endpoint process termination events into a centralized log platform.
• Monitor DNS and network flows for Thunderbird endpoints resolving unauthorized POP3 or SMTP hosts.
• Track installed Thunderbird versions across the fleet and alert on hosts running versions earlier than 153.5.1 or 158.0.1.

How to Mitigate CVE-2026-113868

Immediate Actions Required

• Upgrade all Thunderbird installations to version 153.5.1 or 158.0.1, or later.
• Audit mail account configurations and identify any accounts using NTLM or GSSAPI authentication for POP3 or SMTP.
• Verify that mail clients connect only to trusted mail servers over authenticated TLS sessions.
• Review network paths between clients and mail servers for interception or redirection risks.

Patch Information

Mozilla released fixes in Thunderbird 158.0.1 and Thunderbird 153.5.1. Patch details are available in MFSA-2026-114 and MFSA-2026-115. Administrators managing Thunderbird through enterprise policy should push the updated builds through their standard deployment tooling.

Workarounds

• Switch affected POP3 and SMTP accounts away from NTLM and GSSAPI to alternative authentication mechanisms such as OAuth2 or password-based authentication over TLS.
• Restrict Thunderbird endpoints with egress filtering so they can reach only sanctioned mail servers.
• Require TLS for all mail server connections to reduce the risk of a man-in-the-middle attacker injecting malicious challenges.

# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example enterprise policy snippet to disable NTLM for mail accounts
# Place in the Thunderbird policies.json file
{
  "policies": {
    "DisabledFeatures": ["NTLMAuthentication"]
  }
}