Input validation error in Mozilla Thunderbird - CVE-2025-5986

Vulnerability identifier: #VU111055

CSH Severity: Medium

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5986

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information or perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when handling mailbox:/// links. A remote attacker can create a specially crafted email mailbox:/// links and trigger unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. Additionally, this behavior can be use to leak Windows credentials via SMB links when the email is viewed in HTML mode.

Note, viewing the email in HTML mode is enough to load external content.

Mozilla Thunderbird
Debian Linux
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Ubuntu
openEuler
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
thunderbird-wayland
thunderbird-librnp-rnp
thunderbird-debugsource
thunderbird-debuginfo
thunderbird
thunderbird (Ubuntu package)
thunderbird (Debian package)
thunderbird (Red Hat package)

Install updates from vendor's website.

Mozilla Thunderbird - addressed in versions 128.11.1, 139.0.2
thunderbird-wayland - update to 128.11.1-1
thunderbird-librnp-rnp - update to 128.11.1-1
thunderbird-debugsource - update to 128.11.1-1
thunderbird-debuginfo - update to 128.11.1-1
thunderbird - update to 128.11.1-1
thunderbird - addressed in versions 128.11.1-1.fc41, 128.11.1-1.fc42
thunderbird (Ubuntu package) - update to 1:128.12.0+build1-0ubuntu0.22.04.1
thunderbird (Debian package) - update to 1:128.12.0esr-1~deb12u1
thunderbird (Red Hat package) - addressed in versions 128.12.0-1.el8_2, 128.12.0-1.el8_4, 128.12.0-1.el8_6, 128.12.0-1.el8_8, 128.12.0-1.el8_10, 128.12.0-1.el9_0, 128.12.0-1.el9_2, 128.12.0-1.el9_4, 128.12.0-1.el9_6, 128.12.0-1.el10_0
thunderbird - update to 128.12.0-1.0.1

• https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-50/
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=1968012

• Improper input validation in Mozilla Thunderbird
• Fedora 42 update for thunderbird
• Fedora 41 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Red Hat Enterprise Linux 10 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 9 update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• Anolis OS update for thunderbird
• Debian update for thunderbird
• Red Hat Enterprise Linux 8 update for thunderbird
• openEuler 24.03 LTS SP2 update for thunderbird
• Ubuntu update for thunderbird