During the account setup or when adding a new network calendar, the application accepted storage locations that pointed to other servers, local files, or network shares without adequate validation. A malicious server or a network attacker who could influence the lookup over plain HTTP could trick the client into subscribing to one of those locations. When the client refreshes the calendar, on Windows this process leaks the user's NTLM credentials to the attacker‑controlled host and allows the attacker to write changes back to a network share or overwrite a local file, effectively compromising the user's data and authentication state.

Mozilla Thunderbird is the affected product. Versions older than 159 on any platform, and older than 153.6 on non‑Windows platforms, remain vulnerable. Subsequent releases starting with Thunderbird 159 and 153.6 contain the fix.

The vulnerability is high‑impact due to credential exposure and the potential for tampering with local or network files. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the attack vector is network‑based and the requirement for an attacker to host a rogue calendar location is low. An attacker could exploit this by hosting a rogue calendar server or spoofing an HTTP response that points to a network share, thereby obtaining NTLM credentials and potentially modifying calendar data or local files.