Is CVE-2026-113868 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113868 being exploited in the wild.

How severe is CVE-2026-113868?

Medium severity, with a CVSS score of 5.3, published 20 October 2026.

Which products and versions are affected?

Mozilla Thunderbird before 158.0.1 and 153.5.1.

Is there a fix for CVE-2026-113868?

Yes: fixed in Thunderbird 158.0.1, Thunderbird 153.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113868 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-113868?

Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113868: Thunderbird uninitialized memory disclosure in NTLM authentication

CVE-2026-113868 · Severity: medium · CVSS 5.3 · Published 2026-10-20

Thunderbird, an email client, did not properly validate authentication challenges when connecting to POP3 or SMTP servers using NTLM. A malicious email server could exploit this to leak uninitialized memory from the user's computer or crash Thunderbird entirely. This affects users with accounts configured for NTLM or GSSAPI authentication, exposing sensitive data stored in memory.

Technologies: Mozilla Thunderbird. Vendors: Mozilla.

Quick answers

Is CVE-2026-113868 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113868 being exploited in the wild.
How severe is CVE-2026-113868?: Medium severity, with a CVSS score of 5.3, published 20 October 2026.
Which products and versions are affected?: Mozilla Thunderbird before 158.0.1 and 153.5.1.
Is there a fix for CVE-2026-113868?: Yes: fixed in Thunderbird 158.0.1, Thunderbird 153.5.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113868 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-113868?: Check whether you run Mozilla Thunderbird at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Thunderbird 158.0.1, Thunderbird 153.5.1

Technical details

Thunderbird failed to validate base64-encoded NTLM challenges from POP3/SMTP servers. A malicious server could send invalid base64 to trigger inclusion of uninitialized heap memory in the NTLM response (disclosing sensitive data), or send base64-padding-only challenges to trigger an out-of-bounds read causing a crash. The vulnerability requires NTLM or GSSAPI authentication configuration and affects only NTLM regarding memory disclosure.

Affected products

Mozilla Thunderbird before 158.0.1 and 153.5.1

Timeline

2026-10-20: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.