EUVD-2026-69711
GHSA-5392-q9gh-3cc8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
User must open the email for remote content to be fetched (UI:R); impact is IP and session-metadata disclosure to attacker server, not local data exfiltration (C:L).
Primary rating from Vendor (mozilla).
CVSS VectorVendor: mozilla
Lifecycle Timeline
5DescriptionCVE.org
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.
AnalysisAI
Thunderbird's remote attachment allowlist control (mail.allowed_attachment_hostnames) can be bypassed due to insufficient regex escaping of configured hostname values, allowing attacker-controlled servers to serve remote attachments that the filter was intended to block. Affected are all Thunderbird releases prior to 155 and 153.2; because hostname strings containing dots and other regex metacharacters are interpolated directly into a regular expression without sanitization, a crafted attachment hostname can pattern-match an allowlisted domain without being that domain. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim has previously configured one or more entries in the `mail.allowed_attachment_hostnames` advanced Thunderbird preference - this is a non-default setting that requires deliberate administrator or user action in about:config. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) overstates the impact in two ways: the UI:N metric ignores that a user must at minimum open or preview a message for any remote fetch to occur, and C:H implies direct exfiltration of local sensitive data whereas the actual outcome is IP address and session-metadata disclosure to an attacker-controlled host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Mozilla Thunderbird 155 or Thunderbird 153.2, the vendor-confirmed patched releases per MFSA2026-86 and MFSA2026-88. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your Thunderbird deployments to identify systems with the mail.allowed_attachment_hostnames allowlist configured and document which trusted domains are specified. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Thunderbird
View allMozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox
Alpine Linux: mozjs fixed in 128.3.1-r0
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. Rated high severity (CVSS
Share
External POC / Exploit Code
Leaving vuln.today