Mozilla Thunderbird EUVD-2026-105295

Exploitation requires that the victim's Thunderbird email account is explicitly configured to use NTLM or GSSAPI authentication against a POP3 or SMTP server - accounts using other authentication mechanisms (plain, OAuth2, etc.) are not affected. The attacker must control the mail server's responses, meaning either a malicious/attacker-operated POP3/SMTP server or an on-path MITM position able to inject a crafted NTLM challenge. The uninitialized-memory disclosure path affects ONLY NTLM; the out-of-bounds-read crash (triggered by a challenge consisting solely of base64 padding) affects both NTLM and GSSAPI. Limiting factors: the non-default authentication configuration, the need for attacker control of the server endpoint, and high attack complexity substantially narrow realistic exploitation to targeted or MITM scenarios rather than opportunistic mass attacks. Fixed in Thunderbird 158.0.1.

This is a genuinely moderate-to-low priority issue, not an urgent emergency. The input CVSS of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects high attack complexity, and all exploitation signals point the same way: SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact only 'partial', while no EPSS score, no KEV listing, and no POC indicator were provided (so the only identified exploitation status is 'no public exploit identified at time of analysis'). A notable internal conflict exists in the provided CVSS vector: it records C:N despite the description explicitly stating an uninitialized heap-memory disclosure to the server - the vector appears to capture only the denial-of-service crash (A:H) and omits the confidentiality impact, so the real impact is arguably broader than C:N suggests; verify with the Mozilla advisory. Also noteworthy: although rated AV:N, this is a client-side flaw that is NOT reachable by a conventional remote attacker against a listening service - it requires the victim's Thunderbird to connect to an attacker-controlled or MITM'd POP3/SMTP server with NTLM/GSSAPI configured, which is why AC:H is justified and why real-world risk is limited to targeted or MITM scenarios rather than mass exploitation.

An attacker who controls a POP3/SMTP server (e.g., via a malicious mail provider or an on-path/MITM position) waits for a Thunderbird client configured for NTLM or GSSAPI authentication to connect. During the NTLM handshake the server returns a challenge that is not valid base64 (or is pure base64 padding), causing Thunderbird to either leak uninitialized heap memory back in its NTLM response or perform an out-of-bounds read and crash. No public exploit code was identified at time of analysis; attack complexity is high because the attacker must control the mail server endpoint and the victim must use NTLM/GSSAPI.