CVE-2025-2830: Mozilla Thunderbird

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

Affected products

• Mozilla Thunderbird: before 128.9.2 (fixed in 128.9.2); from 129.0, before 137.0.2 (fixed in 137.0.2)

Published 2025-04-15. Last modified 2026-06-17.