CVE-2025-26696

Crafted email message incorrectly shown as being encrypted

High · published March 10, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Published
2025-03-10T18:41Z
EPSS history
Timeline
  • 10 MAR 18:41Z
    Crafted email message incorrectly shown as being encrypted
    cvelistv5