CVE-2025-3522: mozilla thunderbird Open Redirect
Vulnerability summary
CVE-2025-3522 is a medium (CVSS 6.3) Open Redirect vulnerability in mozilla thunderbird. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 3Timeline
- 15-04-2025PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
- NVDNIST6.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
0.00 pp
From 0.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- thunderbird< 1:128.10.0esr-1~deb12u1 | < 1:128.10.0esr-1
Mozilla1 product
- thunderbird< 128.9.2 | ≥ 129.0, < 137.0.2
Ubuntu1 product
- thunderbird< 1:128.12.0+build1-0ubuntu0.22.04.1
3 vendors · 3 products
