CVE record · 1 source
CVE-2026-113868
CVSS 5.3When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64.
- Vendor
- Microsoft, Mozilla
- Product
- Active Directory / Entra ID, Thunderbird
- CVSS
- 5.3
- Exposure class
- Identity, Email
Coverage
1Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64.
When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap…