Remote Code Execution Vulnerability in Thunderbird by Mozilla

CVE-2025-3909

What is CVE-2025-3909?

This vulnerability in Thunderbird allows an attacker to execute JavaScript in the file:/// context by exploiting the handling of the X-Mozilla-External-Attachment-URL header. By creating a nested email attachment (message/rfc822) and setting its content type as application/pdf, Thunderbird may wrongly treat it as HTML upon opening. This misprocessing, which depends on the auto-saving of the attachment to /tmp and linking it via the file:/// protocol, could facilitate unauthorized JavaScript execution without requiring a file download, affecting Thunderbird versions earlier than 128.10.1 and 138.0.1.

References