CVE-2026-118177 Calendar discovery accepted local file and remote network share locations
CriticalCVSS 9.1
EPSS 0.45%
- Published
- Updated
- Exploit status
- No public exploit known
Description
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/rhel10/thunderbird-flatpak(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/thunderbird(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/thunderbird(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/thunderbird(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/thunderbird(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/thunderbird(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| debian/thunderbird(Debian:12) | < 1:153.6.0esr-1~deb12u2 | 1:153.6.0esr-1~deb12u2 |
| debian/thunderbird(Debian:12) | = 1:102.11.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.12.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.13.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.14.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb11u1 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/thunderbird(Debian:12) | = 1:102.15.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:102.15.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:103.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:104.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:110.0~b4-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:112.0~b1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:113.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:114.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0.1-2 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0~b4-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.1.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.1.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.10.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.11.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.12.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.13.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.14.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.14.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.15.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.15.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.16.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.16.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.2.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.2.2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.3.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.4.1-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.5.2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.6.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.7.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.8.1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb10u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:115.9.0-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:116.0~b7-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:117.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:120.0~b1-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:121.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:122.0~b2-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:124.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:125.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:127.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.0~b5-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.1.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.10.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.11.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.12.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.13.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.14.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.2.3esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.3.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.3.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.4.3esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.5.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.6.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.7.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.8.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:128.9.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:129.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:130.0~b3-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:132.0~b6-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:135.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:136.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:137.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:138.0-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.0.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.1.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.1.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.1esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.10.2esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.11.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.12.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.13.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.13.0esr-2 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.13.0esr-2~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.13.0esr-2~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.13.0esr-2~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.14.0esr-1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.14.0esr-1~deb11u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.14.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.14.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.15.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.15.0esr-1~deb13u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.16.0esr-1~deb12u1 | No fix listed |
| debian/thunderbird(Debian:12) | = 1:140.16.0esr-1~deb13u1 | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2562318 issue-tracking
- www.cve.org
- nvd.nist.gov
- www.mozilla.org
- bugzilla.mozilla.org
- www.mozilla.org
- Debian Security Tracker CVE-2026-118177 vendor-advisory
- Ubuntu CVE tracker vendor-advisory