Thunderbird fix stops Exchange setup sending passwords over plain HTTP

Thunderbird fix stops Exchange setup sending passwords over plain HTTP

20 October 2026: Mozilla has released Thunderbird 158.0.1 and 153.5.1 to fix CVE-2026-113866, a high-rated flaw in which setting up an Exchange account could send the user's password to the network unencrypted, along with two other high-rated bugs. The same day it shipped Firefox 158.0.1, Firefox ESR 153.5.1 and Firefox ESR 115.43.1, which build in the block on the compromised eMudhra intermediate certificates.

Not yet independently verified. Mozilla's advisories do not report exploitation of any of these flaws; we have not checked when Linux distributions and enterprise channels ship the updates. We will update this when it can be confirmed, and remove this note.

The Exchange password flaw

When a user sets up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. "Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password," Mozilla says. The risk is greatest where staff set up accounts on networks the company does not control, such as hotel, café or conference Wi-Fi, and it is a one-time exposure at setup, so passwords entered on an affected version over an untrusted network are worth changing.

The other Thunderbird fixes

• CVE-2026-113867 (high): Thunderbird did not escape attribute values in outgoing XMPP stanzas. Because values from incoming requests were echoed in automatic replies, a remote XMPP user could inject stanzas that the server treats as sent by the user, sending messages or changing contacts and subscriptions without any interaction. Only the chat feature with XMPP accounts is affected.
• CVE-2026-113868 (high): with NTLM authentication to a POP3 or SMTP server, Thunderbird did not check that the server's challenge was valid base64, so a malicious server could make it send uninitialised heap memory in its response; a challenge of only padding crashed it. Accounts using NTLM or GSSAPI are affected, and the memory disclosure applies to NTLM only.
• CVE-2026-113869 (moderate, listed for 158.0.1): a use-after-free when decrypting an S/MIME message while a security device password prompt is open.

Mozilla notes that such flaws generally cannot be exploited through email because scripting is disabled when reading mail.

Firefox and the eMudhra block

Firefox 158.0.1 fixes an SVG boundary bug (high), uninitialised memory in the cubeb audio and video component (moderate) and a PDF viewer denial of service (low), and both ESR releases carry CVE-2026-113470. Mozilla says it blocked the compromised eMudhra intermediates through its OneCRL list on 17 October and pushed that to clients through RemoteSettings the same day; the point releases ship the updated list so that clients block the certificates even where RemoteSettings is disabled by policy or unreachable. That matters for locked-down enterprise fleets, which often switch RemoteSettings off. The background is in our eMudhra item. Mozilla also now issues an advisory for every individual memory-safety bug instead of rolling them into one CVE.

Sources

• Mozilla: MFSA 2026-111, security vulnerabilities fixed in Firefox 158.0.1, 20 October 2026
• Mozilla: MFSA 2026-114, security vulnerabilities fixed in Thunderbird 158.0.1, 20 October 2026
• Mozilla: MFSA 2026-115, security vulnerabilities fixed in Thunderbird 153.5.1, 20 October 2026
• Mozilla: security advisories index (MFSA 2026-112 and 2026-113 for Firefox ESR), 20 October 2026