In brief
- The Exchange problem occurred during account setup.
- The desktop patches are 158.0.1 and 153.5.1 ESR.
- Update through your usual channel; not all repositories receive the package at once.
Passwords could be sent unencrypted
On October 20, Thunderbird released versions 158.0.1 and 153.5.1 ESR with security fixes and smaller bug fixes. For people who use the free email client at work, the most important change concerns Exchange account setup: a flaw could send a password unencrypted while automatically searching for the server.
Mozilla’s advisory identifies the issue as CVE-2026-113866 and rates its impact as high. The AutoDiscover query also used HTTP and, because of a bug, included the credentials the user had entered. An attacker on the network could obtain that password. The advisory describes a vulnerability; it does not say that every account has been compromised.
Two release branches, different fixes
The patches also address flaws in XMPP chat and NTLM authentication. The first could allow actions on someone else’s connection through manipulated automatic responses. The second could expose memory contents when authenticating to a malicious server. These risks arise in specific circumstances; the advisory does not suggest that simply reading any email would trigger them.
Version 158.0.1 also fixes transparent dialog-box backgrounds when using third-party themes. Version 153.5.1 ESR fixes a bug that left behind parts of a failed account setup and blocked further attempts. Each update has its own release notes, so check which release branch you use before comparing version numbers.
How to check your version
If Thunderbird handles its own updates, open the Help menu and choose About Thunderbird to check for them. After the update downloads, restart the app to finish installing it. If Thunderbird came from a Linux distribution’s repository, Mozilla says you need to wait for that distribution’s package.
Official installers are available in Mexican Spanish, and the release archive already includes both versions for 64-bit Linux in that language. This does not mean every repository or app store will update at the same time. Stick to your usual updater or the official website rather than third-party downloads.
Sources and context
Sources used for this article. Follow the links to read the original material.
See the linked sources for more information. Corrections and contact →
