CVE-2024-11159

What it actually does

Remote content loaded inside OpenPGP-encrypted messages can cause the plaintext of the message to be disclosed to an attacker-controlled server.

Why it matters to the business

Attackers may obtain the contents of encrypted email without user interaction, undermining the confidentiality guarantees of OpenPGP-protected communications and exposing sensitive internal or customer information.

How an attack unfolds

An attacker crafts an OpenPGP-encrypted email containing a remote image or other external resource reference, sends it to the victim, and observes the plaintext when the victim's client fetches the remote content during decryption or rendering.

How to fix it

Upgrade Thunderbird to version 128.4.3 or later (for the 128 series) or 132.0.1 or later (for the 132 series).

How to confirm the fix worked

Verify client version is at or above the fixed releases and confirm that remote content loading for encrypted messages is disabled by default or blocked.

Typical attack path

1. Attacker obtains or guesses the recipient's email address
2. Attacker creates a specially formatted OpenPGP-encrypted message embedding a remote resource URL
3. Attacker sends the message to the victim
4. Victim's client decrypts the message and automatically loads the remote content
5. Attacker observes the request and recovers the decrypted plaintext

How to detect it

Review mail client logs and network traffic for unexpected outbound connections triggered by OpenPGP message processing; look for requests to attacker-controlled domains immediately after encrypted message receipt.

What your security team should do

• Immediately upgrade all Thunderbird installations to the fixed versions
• Disable remote content loading for encrypted messages until patches are applied
• Monitor for unusual outbound requests from mail clients during message decryption