CVE-2025-3932: Tracking Links in Attachments Bypassed Remote Content Blocking
It was possible to craft an email that showed a tracking link as an attachment. If the user attempted to open the attachment, Thunderbird automatically accessed the link. The configuration to block remote content did not prevent that. Thunderbird has been fixed to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header of an email.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-3932?
CVE-2025-3932 is considered a high severity vulnerability that could lead to unauthorized access to tracking links.
How do I fix CVE-2025-3932?
To mitigate CVE-2025-3932, users should update Thunderbird to version 138.0.1 or 128.10.1.
Which versions of Thunderbird are affected by CVE-2025-3932?
CVE-2025-3932 affects Thunderbird versions prior to 138.0.1 and 128.10.1.
What is the impact of CVE-2025-3932 on Thunderbird users?
Users of Thunderbird are at risk of being redirected to malicious web pages when opening crafted email attachments.
Is there a workaround for CVE-2025-3932?
There are no effective workarounds for CVE-2025-3932; the recommended action is to update to the latest version.