Thunderbird accepts the homeserver address supplied in the Matrix login response without validation. A malicious or compromised home server can reply with a file:// URL. On Windows the client then redirects all subsequent Matrix traffic to that local file or an attacker‑controlled network share, exposing the user’s NTLM credentials. The flaw does not allow arbitrary code execution but provides attackers a direct path to credential theft. The impact is limited to users of Thunderbird on Windows; other operating systems are unaffected.

Mozilla Thunderbird is affected. The vulnerability impacts all releases prior to Thunderbird 159 and to the stable 153.6; both pre‑159 and pre‑153.6 versions process the homeserver URL insecurely. The issue is fixed in Thunderbird 159 and 153.6.

Because the flaw requires a malicious Matrix home server to supply a file:// URL, the attack vector is remote and relies on the application trusting server data. No public exploitation has been reported and the EPSS score is not available, but the potential to exfiltrate NTLM credentials on Windows makes the risk significant for users who connect to unknown or untrusted homeservers. The CVSS score is omitted in the public data, but the impact severity is high due to credential compromise. The vulnerability is not listed in the CISA KEV catalog, so widespread exploitation has not yet been documented.