High severity7.5NVD Advisory· Published May 14, 2025· Updated Apr 13, 2026
CVE-2025-3875
CVE-2025-3875
Description
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- www.mozilla.org/security/advisories/mfsa2025-34/nvdVendor Advisory
- www.mozilla.org/security/advisories/mfsa2025-35/nvdVendor Advisory
- bugzilla.mozilla.org/show_bug.cginvdPermissions Required
- lists.debian.org/debian-lts-announce/2025/05/msg00022.htmlnvd
News mentions
0No linked articles in our index yet.