CVE-2026-113868
Description
A flaw was found in Thunderbird. When authenticating to an email server using NT LAN Manager (NTLM) or Generic Security Services Application Program Interface (GSSAPI), the client fails to properly validate the server's authentication challenge format. A malicious server can exploit this flaw by sending a specially crafted challenge, causing Thunderbird to return uninitialized memory and leading to information disclosure. A malformed challenge can also trigger an out-of-bounds read that crashes the client, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation is confined to the desktop user session and requires connecting to a hostile or intercepted mail server configured for specific authentication schemes. Under typical enterprise deployments, Thunderbird connects only to vetted corporate servers, and standard password authentication mechanisms are unaffected by this defect. In the event an adversary controls the upstream mail endpoint, the blast radius is restricted to reading uninitialized heap contents or causing the local client process to terminate unexpectedly.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | High |
| Privileges Required | None | N/A | Low |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Memory; Read Application Data
When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Instability
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other
Technical Impact: Unexpected State; Varies by Context
The consequences vary depending on the type of resource and how it is used within the product.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
