CVE-2026-118174 Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118174?
CVE-2026-118174 is a vulnerability in Mozilla Thunderbird, published on 27 Oct 2026.
Official description
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Which versions are affected by CVE-2026-118174?
How do I fix CVE-2026-118174?
No fix has been published for CVE-2026-118174 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118174 being exploited?
There is no known exploitation of CVE-2026-118174 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-118174, GHSA-7h4p-h257-qp65, UBUNTU-CVE-2026-118174.