Thunderbird has a check designed to prevent mailbox: URLs from accessing files on remote Windows network shares. This check can be bypassed by using extended-length UNC paths, allowing a specially crafted email to cause Thunderbird to connect to an attacker‑controlled SMB server. The connection transmits the user’s Windows account name and NTLM authentication data, exposing credentials that can be used for offline cracking or relay attacks. This is an information exposure vulnerability (CWE‑200).

Mozilla Thunderbird running on Windows is affected. The flaw is present in all Thunderbird releases prior to 159 and also in releases before 153.6, while version 159 and later, as well as 153.6 and later, contain the fix. No other operating systems are impacted.

The vulnerability can be exploited by delivering a malicious email that contains a carefully crafted mailbox: URL with an extended‑length UNC path. The attacker does not need elevated privileges; a normal Thunderbird user must open the email. While the EPSS score is not available and the issue is not listed in the CISA KEV catalog, the attack vector relies on user interaction of a crafted email, implying a moderate likelihood of exploitation in targeted phishing campaigns. The lack of a public exploit further suggests that the risk may remain low to moderate under normal conditions, but the confidentiality impact is severe due to credential disclosure.