CVE-2026-118175
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed…
- Risk score
- 52/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 27 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipie…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Last activity 27 Oct 2026. Patch Forecast updates every hour.