CVE-2025-26696

—

CVSS 3.1

7.0 high

EPSS

<1%p27

Published

Mar 10, 2025 (Mar 10, 2025)

Modified

Jun 17, 2026

Description

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

Vendors: mozilla
Products: thunderbird
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.