CVE-2025-3909: JavaScript Execution via Spoofed PDF Attachment and file:/// Link
Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 138.0.1 - Upgrade
Upgrade
ubuntu/thunderbirdto a version that resolves this vulnerability.Fixed in 1:128.12.0+build1-0ubuntu0.22.04.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 128.10.1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.7.0esr-1~deb12u1Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.7.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.7.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 128.10.1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3909?
CVE-2025-3909 is classified as a high severity vulnerability due to the potential for executing JavaScript in insecure contexts.
How do I fix CVE-2025-3909?
To fix CVE-2025-3909, update your Thunderbird application to versions 128.10.1 or 138.0.1 or later.
What versions of Thunderbird are affected by CVE-2025-3909?
CVE-2025-3909 affects Mozilla Thunderbird versions prior to 128.10.1 and 138.0.1.
What type of attack is possible with CVE-2025-3909?
CVE-2025-3909 allows for the execution of JavaScript code through crafted email attachments.
Is there a workaround for CVE-2025-3909?
Currently, the recommended approach for CVE-2025-3909 is to ensure you are using the latest version of Thunderbird, since no specific workaround is noted.