CVE-2025-3875

—

CVSS 3.1

7.5 high

EPSS

<1%p31

Published

May 14, 2025 (May 14, 2025)

Modified

Jun 17, 2026

Description

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Vendors: mozilla
Products: thunderbird
Weakness: CWE-290
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.