CVEvulnerability

CVE-2025-3875

7.5 HIGH Published 2025-05-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-290

Description

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Affected configurations

• mozilla thunderbird (< 128.10.0) • mozilla thunderbird (>= 129.0 < 138.0.1)

Related

Weakness · CWE (1)

  • CWE-290 Authentication Bypass by Spoofing weakness

References