CVE-2019-11739

What it actually does

Crafted multipart/alternative messages containing encrypted S/MIME parts cause Thunderbird to include decrypted plaintext when generating an HTML reply or forward, exposing the original encrypted content.

Why it matters to the business

Sensitive encrypted email content can be unintentionally disclosed to recipients of replies or forwards, undermining the confidentiality of protected communications and potentially violating regulatory or contractual obligations.

How an attack unfolds

An attacker crafts an email embedding encrypted S/MIME data inside a multipart/alternative structure, sends it to a target Thunderbird user, and relies on the victim performing an HTML reply or forward to trigger automatic plaintext leakage into the outgoing message.

How to fix it

Upgrade Mozilla Thunderbird to version 68.1 or newer (or 60.9 or newer for the ESR branch) as soon as possible; ensure automatic updates are enabled and verify the installed version after patching.

How to confirm the fix worked

Confirm the Thunderbird version is at least 68.1 (or 60.9 ESR); test by sending a crafted multipart/alternative S/MIME message and verifying that plaintext is no longer leaked on HTML reply/forward.

Typical attack path

1. Attacker prepares multipart/alternative email with encrypted S/MIME part
2. Victim receives and opens the message in Thunderbird
3. Victim initiates HTML-mode reply or forward
4. Plaintext of the encrypted part is automatically included in the composed message
5. Victim sends the reply/forward, leaking the plaintext to intended or unintended recipients

How to detect it

Review sent email folders or message stores for unexpected plaintext appearing in HTML replies or forwards that originated from encrypted S/MIME messages; correlate with inbound message headers containing multipart/alternative structures.

What your security team should do

• Immediately deploy Thunderbird 68.1+ (or 60.9+ ESR) across all endpoints
• Disable HTML composition by default where feasible until patching is complete
• Educate users to avoid HTML replies/forwards on sensitive encrypted messages until fixed
• Monitor vendor advisories for any follow-on updates