CVE-2025-3875

Reference Links

• https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
• https://www.mozilla.org/security/advisories/mfsa2025-34/
• https://www.mozilla.org/security/advisories/mfsa2025-35/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-34/
• https://www.mozilla.org/en-US/security/advisories/mfsa2025-35/

Parent vulnerabilities

(Appears in the following advisories)

• MFSA2025-34
• MFSA2025-35

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2025-3875
• CVE-2025-3877
• CVE-2025-3909
• CVE-2025-3932

Frequently Asked Questions

• What is the severity of CVE-2025-3875?

  CVE-2025-3875 is classified as a medium severity vulnerability due to its potential for sender spoofing.

• How do I fix CVE-2025-3875?

  To fix CVE-2025-3875, update Mozilla Thunderbird to version 128.10.1 or 138.0.1 or later.

• What versions of Thunderbird are affected by CVE-2025-3875?

  CVE-2025-3875 affects versions of Mozilla Thunderbird prior to 128.10.1 and prior to 138.0.1.

• What can happen if I am affected by CVE-2025-3875?

  If affected by CVE-2025-3875, users may be misled by emails that appear to come from spoofed addresses.

• Is there a workaround for CVE-2025-3875 before applying the patch?

  There are no documented workarounds for CVE-2025-3875, so users should apply the required updates as soon as possible.