CVE-2025-3522

CVE Details

Release Date:	2025-04-15
Impact:	Important	What is this?

Description

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validated or sanitized, it can reference internal resources like chrome:// or SMB share file:// links, potentially leading to hashed Windows credential leakage and opening the door to more serious security issues. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

See more information about CVE-2025-3522 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.4
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	Required
Scope:	Changed
Confidentiality Impact:	High
Integrity Impact:	None
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 8 (thunderbird)	ELSA-2025-4649	2025-05-07
Oracle Linux version 9 (thunderbird)	ELSA-2025-4229	2025-04-28
Oracle Linux version 9 (thunderbird)	ELSA-2025-7435	2025-05-22