CVE-2026-118175
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Status
- Deferred - security@mozilla.org
- Published
- 2026-10-27
- Last modified
- 2026-10-28
Affected products
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=2081720
- https://www.mozilla.org/security/advisories/mfsa2026-121/
- https://www.mozilla.org/security/advisories/mfsa2026-122/
