CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL

What is CVE-2025-3523?

CVE-2025-3523 is a medium-severity vulnerability in Mozilla Thunderbird, published on 15 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Weakness: CWE-451

Which versions are affected by CVE-2025-3523?

It affects 1 product.

Products include Mozilla Thunderbird.

How do I fix CVE-2025-3523?

Upgrade to a fixed version.

Is CVE-2025-3523 being exploited?

There is no known exploitation of CVE-2025-3523 in the wild and no public exploit code.

Other vulnerabilities in Mozilla Thunderbird

• CVE-2026-92238 Ambiguous parsing of mail headers Critical 9.8
• CVE-2026-84637 Calendar invitation attachments could launch local executables Critical 9.8
• CVE-2021-43529 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11703 Memory corruption in Thunderbird Critical 9.8
• CVE-2019-11704 Memory corruption in Thunderbird Critical 9.8

All Mozilla Thunderbird vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2025-3523, GHSA-4h7q-pj8m-5675, UBUNTU-CVE-2025-3523.