CVE-2025-3932

Vulnerability

CVE-2025-3932 describes a flaw in Thunderbird where a specially crafted email could display a tracking link masquerading as an attachment [1][2]. When the user attempts to open this fake attachment, Thunderbird automatically accesses the link without prompting or applying the standard remote content blocking configuration [1][2]. The root cause lies in the handling of the X-Mozilla-External-Attachment-URL header, which was not being properly filtered by the remote content protection mechanism [1][2].

Exploitation

An attacker can send an email that appears to contain an attachment, but instead includes a tracking URL in the attachment field. The attack requires no authentication beyond sending a mail to the victim. If the victim clicks on the attachment, Thunderbird will fetch the URL, bypassing the user's preference to block remote content [1][2]. This can be used to confirm that the email address is active and that the message was read, enabling email tracking and potentially supporting further phishing or social engineering attacks.

Impact

The impact is primarily a privacy and information disclosure issue. An attacker can determine when and if a recipient opens an email, bypassing anti-tracking protections. While the vulnerability is rated as low impact by Mozilla [1][2], it undermines a core privacy feature of Thunderbird (remote content blocking). Combined with other vulnerabilities (e.g., CVE-2025-3909 [1][2]), similar attack vectors could be chained for more severe consequences.

Mitigation

Thunderbird has been fixed in versions 128.10.1 and 138.0.1 to no longer allow access to web pages listed in the X-Mozilla-External-Attachment-URL header [1][2]. Users are urged to update to these versions or later. No workaround is mentioned; the fix completely removes the ability for that header to bypass remote content blocking.