When Thunderbird displays a message that contains an OpenPGP key attachment, it automatically loads the attachment's content to offer key import. An attacker can craft the attachment to be an external attachment pointing to an arbitrary URL. Thunderbird then loads that URL without any user interaction, bypassing the remote content blocking feature. On Windows, a URL pointing to an attacker‑controlled SMB share can trigger a request that leaks the user's NTLM credentials to the attacker, while on other operating systems the flaw still allows remote content to be fetched without user consent.

This issue affects Microsoft Windows users of Mozilla Thunderbird versions that have not yet applied the security update. The vulnerability was addressed starting with Thunderbird 159 and with the 153.6 release. Earlier Thunderbird builds before these versions are vulnerable, and only the Windows builds can leak NTLM credentials; other platforms are affected only by the ability to load external content unprompted.

The CEV does not provide an EPSS score or a CVSS score, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the legacy vulnerability permits an attacker to deliver a crafted message that automatically requests an external resource. On Windows systems the exploit can retrieve NTLM credentials, which provides a path to compromise user accounts. The attack is straightforward: an email with a malicious key attachment is sufficient; no additional authentication or privileged access is required. Because the vulnerability bypasses user interaction and the remote content block setting, the risk is significant for users who do not promptly update and for environments where Windows credential leakage could have catastrophic consequences.