CVE-2025-3523

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1958385
• https://www.mozilla.org/security/advisories/mfsa2025-26/
• https://www.mozilla.org/security/advisories/mfsa2025-27/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-27/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-26/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2025-26
• MFSA2025-27

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2025-3522
• CVE-2025-2830
• CVE-2025-3523

Frequently Asked Questions

• What is the severity of CVE-2025-3523?

  CVE-2025-3523 is classified as a moderate severity vulnerability due to the potential for user deception.

• How does CVE-2025-3523 affect users?

  CVE-2025-3523 misleads users by displaying only the last attachment link in the hover text, which could lead to the unintentional downloading of malicious content.

• Can CVE-2025-3523 be exploited easily?

  Exploitation of CVE-2025-3523 requires user interaction as it relies on clicking the attachment links.

• What versions of Thunderbird are affected by CVE-2025-3523?

  CVE-2025-3523 affects Mozilla Thunderbird versions prior to 137.0.2 and 128.9.2.

• How do I fix CVE-2025-3523?

  To mitigate CVE-2025-3523, update to the latest version of Mozilla Thunderbird that addresses this vulnerability.