CVE-2025-5986

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-5986", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "state": "PUBLISHED", "assignerShortName": "mozilla", "dateReserved": "2025-06-10T20:07:11.178Z", "datePublished": "2025-06-11T12:07:50.430Z", "dateUpdated": "2026-04-13T14:28:34.275Z"}, "containers": {"cna": {"affected": [{"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"status": "unaffected", "version": "128.11.1", "lessThanOrEqual": "128.*", "versionType": "rpm"}, {"status": "unaffected", "version": "139.0.2", "lessThanOrEqual": "*", "versionType": "rpm"}]}], "descriptions": [{"lang": "en", "value": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2."}]}], "title": "Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links", "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-49/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-50/"}], "credits": [{"lang": "en", "value": "Dario Wei\u00dfer"}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:28:34.275Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-451", "lang": "en", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T13:20:09.964885Z", "id": "CVE-2025-5986", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:20:28.401Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:06:43.375Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:06:43.375Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-5986", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-11T13:20:09.964885Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:16:47.881Z"}}], "cna": {"title": "Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links", "credits": [{"lang": "en", "value": "Dario Wei\u00dfer"}], "affected": [{"vendor": "Mozilla", "product": "Thunderbird", "versions": [{"status": "unaffected", "version": "128.11.1", "versionType": "rpm", "lessThanOrEqual": "128.*"}, {"status": "unaffected", "version": "139.0.2", "versionType": "rpm", "lessThanOrEqual": "*"}]}], "references": [{"url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-49/"}, {"url": "https://www.mozilla.org/security/advisories/mfsa2025-50/"}], "descriptions": [{"lang": "en", "value": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.", "supportingMedia": [{"type": "text/html", "value": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.", "base64": false}]}], "providerMetadata": {"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "shortName": "mozilla", "dateUpdated": "2026-04-13T14:28:34.275Z"}}}, "cveMetadata": {"cveId": "CVE-2025-5986", "state": "PUBLISHED", "dateUpdated": "2026-04-13T14:28:34.275Z", "dateReserved": "2025-06-10T20:07:11.178Z", "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe", "datePublished": "2025-06-11T12:07:50.430Z", "assignerShortName": "mozilla"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Thunderbird", "vendor": "Mozilla", "versions": [{"lessThanOrEqual": "128.*", "status": "unaffected", "version": "128.11.1", "versionType": "rpm"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "139.0.2", "versionType": "rpm"}]}], "source": "security@mozilla.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "matchCriteriaId": "02A11E50-4C28-475B-B957-B79BD0654056", "versionEndExcluding": "128.11.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:-:*:*:*", "matchCriteriaId": "83C7414D-BCC3-4887-88B9-06E2F62FD328", "versionEndExcluding": "139.0.2", "versionStartIncluding": "135.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2."}, {"lang": "es", "value": "Un correo electr\u00f3nico HTML manipulado que utiliza enlaces mailbox:/// puede desencadenar descargas autom\u00e1ticas no solicitadas de archivos .pdf al escritorio o directorio personal del usuario sin previo aviso, incluso con el guardado autom\u00e1tico desactivado. Este comportamiento puede utilizarse para llenar el disco con datos innecesarios (p. ej., usando /dev/urandom en Linux) o para filtrar credenciales de Windows mediante enlaces SMB al visualizar el correo electr\u00f3nico en modo HTML. Si bien se requiere la interacci\u00f3n del usuario para descargar el archivo .pdf, la ofuscaci\u00f3n visual puede ocultar el desencadenador de la descarga. Ver el correo electr\u00f3nico en modo HTML es suficiente para cargar contenido externo. Esta vulnerabilidad afecta a Thunderbird (versi\u00f3n anterior a la 128.11.1) y Thunderbird (versi\u00f3n anterior a la 139.0.2)."}], "id": "CVE-2025-5986", "lastModified": "2026-06-17T09:49:09.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5986", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-06-11T13:20:09.964885Z", "version": "2.0.3"}}]}, "published": "2025-06-11T12:15:29.183", "references": [{"source": "security@mozilla.org", "tags": ["Broken Link"], "url": "https://bugzilla.mozilla.org/buglist.cgi?bug_id=1958580%2C1968012"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-49/"}, {"source": "security@mozilla.org", "tags": ["Vendor Advisory"], "url": "https://www.mozilla.org/security/advisories/mfsa2025-50/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"}], "sourceIdentifier": "security@mozilla.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:10195", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "thunderbird-0:128.12.0-1.el10_0", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-07-02T00:00:00Z"}, {"advisory": "RHSA-2025:10246", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "thunderbird-0:128.12.0-1.el8_10", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-07-02T00:00:00Z"}, {"advisory": "RHSA-2025:10166", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "thunderbird-0:128.12.0-1.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10165", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "thunderbird-0:128.12.0-1.el8_4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10164", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "thunderbird-0:128.12.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10164", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "thunderbird-0:128.12.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10164", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "thunderbird-0:128.12.0-1.el8_6", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10163", "cpe": "cpe:/a:redhat:rhel_tus:8.8", "package": "thunderbird-0:128.12.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10163", "cpe": "cpe:/a:redhat:rhel_e4s:8.8", "package": "thunderbird-0:128.12.0-1.el8_8", "product_name": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10196", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "thunderbird-0:128.12.0-1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-07-02T00:00:00Z"}, {"advisory": "RHSA-2025:10161", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "thunderbird-0:128.12.0-1.el9_0", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10160", "cpe": "cpe:/a:redhat:rhel_e4s:9.2", "package": "thunderbird-0:128.12.0-1.el9_2", "product_name": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "release_date": "2025-07-01T00:00:00Z"}, {"advisory": "RHSA-2025:10159", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "thunderbird-0:128.12.0-1.el9_4", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-07-01T00:00:00Z"}], "bugzilla": {"description": "thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links", "id": "2372281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372281"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-400", "details": ["A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.", "A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content."], "name": "CVE-2025-5986", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rhel10/thunderbird-flatpak", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "thunderbird", "product_name": "Red Hat Enterprise Linux 7"}], "public_date": "2025-06-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-5986\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-5986"], "statement": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-20T17:01:09.109683+00:00", "value": {"mitigation_remediation": ["Update Thunderbird to the official fixed release (128.11.1 or newer).", "Configure Thunderbird to block automatic downloads of external content or disable loading of external resources in HTML emails.", "Verify email authenticity and avoid opening emails with mailbox:/// links from untrusted senders."], "summary": {"action": "Immediate Patch", "impact": "Credential leakage and disk space exhaustion through unsolicited downloads"}, "threat_synthesis": {"affected_systems": "Mozilla Thunderbird is the only publicly listed affected product. All Thunderbird releases prior to 128.11.1 on Linux and prior to 139.0.2 on other platforms are vulnerable. Red\u202fHat Enterprise Linux systems running Thunderbird older than those patches may also be impacted, though the anomaly chiefly relates to the Thunderbird client itself. The CVE references indicate that the issue also appears in Debian LTS announcements, suggesting that base distributions adopting Thunderbird versions before the fixed releases can be at risk.", "description_and_impact": "A crafted HTML email that includes mailbox:/// links can cause Thunderbird to automatically download PDF files to the user\u2019s desktop or home directory without prompting, even when auto\u2011saving is disabled. Because the download is triggered when the user opens the email in HTML mode, visual obfuscation can hide the trigger and allow an attacker to fill the victim\u2019s disk with arbitrary data or, on Windows, leak credentials through SMB links. The attacker must still obtain a user\u2019s attention to view the email, but once viewed, the automatic download delivers the storage\u2011exhaustion or credential\u2011exfiltration effect. This flaw is identified as a loss of confidentiality through credential exposure and loss of integrity through unauthorized data placement, classified under CWE\u2011400 and CWE\u2011451.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity, with an EPSS of less than 1% implying a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been observed as a widely exploited vector. Attackers can exploit it by phishing with malicious HTML emails that, when opened, cause Thunderbird to silently download large or random data, exhausting disk space, or to resolve SMB links that expose credentials. While user interaction is required to view the email, visual obfuscation can reduce detection, making this a realistic social\u2011engineering attack in environments with lenient email parsing settings."}}}}, "created": "2025-06-24T09:51:38.393391+00:00", "updated": "2026-04-20T17:15:12.542920+00:00", "vendors": ["mozilla", "mozilla$PRODUCT$thunderbird"]}