Skip to main content

Thunderbird CVE-2025-5986

| EUVDEUVD-2025-18099 MEDIUM
User Interface (UI) Misrepresentation of Critical Information (CWE-451)
2025-06-11 security@mozilla.org
Information Disclosure Microsoft Mozilla Thunderbird
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network attack vector, low complexity, no privileges, user interaction required, availability impact only.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative
SUSE
MEDIUM
qualitative
Red Hat
6.5 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 14, 2026 - 21:09 euvd
EUVD-2025-18099
Analysis Generated
Mar 14, 2026 - 21:09 vuln.today
CVE Published
Jun 11, 2025 - 12:15 nvd
MEDIUM 6.5

DescriptionCVE.org

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.

AnalysisAI

Mishandling of mailbox:/// links in Thunderbird allows automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This can be abused to fill the disk with garbage data or leak Windows credentials via SMB links when the email is viewed in HTML mode. No public exploit identified at time of analysis, but EPSS score is 0.15% (low).

Technical ContextAI

The vulnerability is a CWE-451 (User Interface (UI) Misrepresentation of Critical Information) in Mozilla Thunderbird, an email client. The issue involves the handling of mailbox:/// URI scheme, which can trigger automatic downloads of .pdf files without user consent. The CPE data confirms Thunderbird versions before 128.11.1 and before 139.0.2 are affected. The root cause is insufficient validation of download triggers in HTML email rendering.

RemediationAI

Upgrade to Thunderbird 128.11.1 or later (ESR) or Thunderbird 139.0.2 or later (release). Patches are available from Mozilla at https://www.mozilla.org/security/advisories/mfsa2025-49/ and https://www.mozilla.org/security/advisories/mfsa2025-50/. For Linux distributions, apply updates via USN-7663-1 (Ubuntu), DLA-4239-1/DSA-5959-1 (Debian), or RHSA advisories (Red Hat). As a workaround, disable HTML email rendering and view emails in plain text only, which prevents automatic loading of external content and mailbox:/// links. Note that this may reduce usability for HTML-formatted emails.

More in Thunderbird

View all
CVE-2013-1690 HIGH POC
8.8 Jun 26

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before

CVE-2013-0758 CRITICAL POC
9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
CVE-2013-0753 CRITICAL POC
9.3 Jan 13

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox b
CVE-2012-3993 CRITICAL POC
9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
CVE-2013-1710 CRITICAL POC
10.0 Aug 07

The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird befo
CVE-2013-0757 CRITICAL POC
9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
CVE-2014-1510 CRITICAL POC
9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
CVE-2014-1511 CRITICAL POC
9.8 Mar 19

Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remo
CVE-2016-1960 HIGH POC
8.8 Mar 13

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox

CVE-2024-9680 CRITICAL POC
9.8

Alpine Linux: mozjs fixed in 128.3.1-r0
CVE-2015-0816 MEDIUM POC
5.0 Apr 01

Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource
CVE-2013-2566 MEDIUM POC
5.9 Mar 15

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all
CVE-2024-43461 HIGH
8.8
CVE-2025-8043 CRITICAL POC
9.8
CVE-2024-55889 HIGH POC
7.2
CVE-2025-7021 MEDIUM POC
6.5
CVE-2022-2800 MEDIUM POC
6.1
CVE-2026-0907 CRITICAL
9.8
CVE-2026-0906 CRITICAL
9.8
CVE-2026-2634 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
thunderbird
Release Status Version
oracular ignored end of life, was needs-triage
noble not-affected code not present
plucky not-affected code not present
upstream released 128.11.1
jammy released 1:128.12.0+build1-0ubuntu0.22.04.1
focal DNE -
USN-7663-1

Debian

thunderbird
Release Status Fixed Version Urgency
bullseye fixed 1:128.12.0esr-1~deb11u1 -
bullseye (security) fixed 1:140.8.0esr-1~deb11u1 -
bookworm fixed 1:128.12.0esr-1~deb12u1 -
bookworm (security) fixed 1:140.8.0esr-1~deb12u1 -
trixie (security), trixie fixed 1:140.8.0esr-1~deb13u1 -
forky, sid fixed 1:140.8.0esr-1 -
(unstable) fixed 1:128.12.0esr-1 -
DLA-4239-1 DSA-5959-1

SUSE

Severity: Medium
Product Status
SUSE Liberty Linux 8 Fixed
SUSE Liberty Linux 9 Fixed
SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 Fixed
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6 Fixed

Share

CVE-2025-5986 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy