CVE-2025-3909: mozilla thunderbird
Vulnerability summary
CVE-2025-3909 is a high (CVSS 8.1) vulnerability in mozilla thunderbird. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 17 · Related 4Timeline
- 14-05-2025PublishedVulnerability first disclosed.
- 13-04-2026Last modifiedVulnerability information updated.
Description
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.03 pp
From 0.44% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- thunderbird< 1:128.10.1esr-1~deb12u1 | < 1:128.10.1esr-1
Mozilla1 product
- thunderbird< 128.10.1 | ≥ 129.0, < 138.0.1
Ubuntu1 product
- thunderbird< 1:128.12.0+build1-0ubuntu0.22.04.1
3 vendors · 3 products
