CVE-2025-3875

Sender Spoofing via Malformed From Header in Thunderbird

High · published May 14, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
32.6
In the wild
Unconfirmed
What it is

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00396 · 32.6th percentile
Published
2025-05-14T16:56Z
EPSS history
Timeline
  • 14 MAY 16:56Z
    Sender Spoofing via Malformed From Header in Thunderbird
    cvelistv5