The vulnerability enables a component of the application to issue requests to any arbitrary host by clicking a specially crafted news: or snews: link. The link contains a message‑ID that Thunderbird interprets literally, causing the client to connect to the host and port specified by the link and send the unmodified contents of that message‑ID, potentially including line breaks that can turn into arbitrary commands. This behavior allows an attacker to direct the client to communicate with any service reachable from the user's network without authentication or user consent.

The affected product is Mozilla Thunderbird. Versions before 159, including Thunderbird 153.6, are vulnerable. The vulnerability has been addressed in Thunderbird 159 and in the 153.6 release line.

The exploitability relies on a user clicking a malicious link, after which Thunderbird silently initiates a connection to an arbitrary host, sometimes without TLS when the snews: scheme is used. Because the client may send arbitrary commands, the impact can extend to remote command execution on vulnerable services and to data exfiltration or denial of service. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a probability metric does not diminish the likelihood that malicious actors will craft such links. The risk is considered high due to the ability to target internal or external infrastructure that is otherwise unreachable using normal client settings.