CVE-2025-3875 Sender Spoofing via Malformed From Header in Thunderbird
Attackers can spoof sender addresses in Thunderbird by using malformed From headers, potentially misleading users about the email origin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-3875?
CVE-2025-3875 is a high-severity vulnerability in Mozilla Thunderbird, published on 14 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
Weakness: CWE-290
Which versions are affected by CVE-2025-3875?
It affects 1 product.
Products include Mozilla Thunderbird.
How do I fix CVE-2025-3875?
Upgrade to a fixed version.
Is CVE-2025-3875 being exploited?
There is no known exploitation of CVE-2025-3875 in the wild and no public exploit code.
Other vulnerabilities in Mozilla Thunderbird
Sources
Also known as DEBIAN-CVE-2025-3875, GHSA-rg69-33g2-mp48, UBUNTU-CVE-2025-3875.