Thunderbird processes RSS feeds that contain an itunes:new-feed-url or newLocation element. If a malicious feed supplies a file: URL, the application permanently changes the stored subscription to that local or network location. On subsequent updates Thunderbird reads the file, which on Windows can capture NTLM credentials. The flaw represents a Path Traversal (CWE-22) that allows reading of arbitrary local files, and an Information Exposure vulnerability (CWE-200) that permits credential leakage. Because the bug does not involve code execution, the impact is limited to data disclosure, but credential theft on Windows can have severe consequences.

Affected users run Thunderbird versions prior to 159 or 153.6. Mozilla released fixes in those releases; upgrading to the latest Thunderbird mitigates the issue. The issue is present on all operating systems with local‑file reading functionality, but credential leakage is limited to Windows environments.

The exploit does not require code execution; an attacker who can supply a feed or alter an HTTP‑served feed can trigger the data read. Because the EPSS score is not available and the vulnerability is not listed in the KEV catalog, the immediate risk level is moderate, but the potential for credential theft on Windows makes patching a priority. The CVSS score is not provided here.