A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4239 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4239-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     July 11, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : thunderbird     Version        : 1:128.12.0esr-1~deb11u1     CVE ID         : CVE-2025-5986 CVE-2025-6424 CVE-2025-6425 CVE-2025-6429                      CVE-2025-6430

    Multiple vulnerabilities have been fixed in the email, calendar and     contacts client Thunderbird.

    CVE-2025-5986

        Unsolicited File Download, Disk Space Exhaustion, and         Credential Leakage via mailbox:/// Links

    CVE-2025-6424

        Use-after-free in FontFaceSet

    CVE-2025-6425

        The WebCompat WebExtension shipped exposed a persistent UUID

    CVE-2025-6429

        Incorrect parsing of URLs could have allowed embedding of youtube.com

    CVE-2025-6430

        Content-Disposition header ignored when a file is included         in an embed or object tag

    For Debian 11 bullseye, these problems have been fixed in version     1:128.12.0esr-1~deb11u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2025:10246 advisory.

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5959 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5959-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     July 06, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : thunderbird     CVE ID         : CVE-2025-5986 CVE-2025-6424 CVE-2025-6425 CVE-2025-6429                      CVE-2025-6430

    Multiple security issues were discovered in Thunderbird, which could     result in the execution of arbitrary code.

    For the stable distribution (bookworm), these problems have been fixed in     version 1:128.12.0esr-1~deb12u1.

    We recommend that you upgrade your thunderbird packages.

    For the detailed security status of thunderbird please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/thunderbird

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:10196 advisory.

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-10246 advisory.

    [128.12.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079820]
    - Add Oracle prefs file

    [128.12.0]
    - Add OpenELA debranding

    [128.12.0-1]
    - Update to 128.12.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-10195 advisory.

    [128.12.0-1.0.1]
    - Add Oracle prefs

    [128.12.0-1]
    - Update to 128.12.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10246 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-10196 advisory.

    [128.12.0-1.0.1]
    - Fix prefs for new nss [Orabug: 37079813]
    - Add Oracle prefs

    [128.12.0]
    - Add OpenELA debranding

    [128.12.0-1]
    - Update to 128.12.0 build1

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10196 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10195 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10163 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10164 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10160 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10165 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10159 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10166 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:10161 advisory.

    Mozilla Thunderbird is a standalone mail and newsgroup client.

    Security Fix(es):

    * thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (CVE-2025-5986)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02158-1 advisory.

    Mozilla Thunderbird 128.11.1

    - CVE-2025-5986: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:///     Links (MFSA 2025-49) (bsc#1244468).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 128.11.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2896 advisory.

    A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird     < 139.0.2. (CVE-2025-5986)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-883496c803 advisory.

    Update to 128.11.1

    * https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1ac9269cc4 advisory.

    Update to 128.11.1

    * https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 128.11.1esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-162-01 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.11.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-49 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.11.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-49 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242006	Debian dla-4239 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
241536	AlmaLinux 8 : thunderbird (ALSA-2025:10246)	Nessus	Alma Linux Local Security Checks	critical
241386	Debian dsa-5959 : thunderbird - security update	Nessus	Debian Local Security Checks	critical
241267	AlmaLinux 9 : thunderbird (ALSA-2025:10196)	Nessus	Alma Linux Local Security Checks	medium
241225	Oracle Linux 8 : thunderbird (ELSA-2025-10246)	Nessus	Oracle Linux Local Security Checks	medium
241219	Oracle Linux 10 : thunderbird (ELSA-2025-10195)	Nessus	Oracle Linux Local Security Checks	medium
241217	RHEL 8 : thunderbird (RHSA-2025:10246)	Nessus	Red Hat Local Security Checks	critical
241204	Oracle Linux 9 : thunderbird (ELSA-2025-10196)	Nessus	Oracle Linux Local Security Checks	medium
241202	RHEL 9 : thunderbird (RHSA-2025:10196)	Nessus	Red Hat Local Security Checks	critical
241200	RHEL 10 : thunderbird (RHSA-2025:10195)	Nessus	Red Hat Local Security Checks	critical
241149	RHEL 8 : thunderbird (RHSA-2025:10163)	Nessus	Red Hat Local Security Checks	critical
241148	RHEL 8 : thunderbird (RHSA-2025:10164)	Nessus	Red Hat Local Security Checks	critical
241142	RHEL 9 : thunderbird (RHSA-2025:10160)	Nessus	Red Hat Local Security Checks	critical
241141	RHEL 8 : thunderbird (RHSA-2025:10165)	Nessus	Red Hat Local Security Checks	critical
241139	RHEL 9 : thunderbird (RHSA-2025:10159)	Nessus	Red Hat Local Security Checks	critical
241119	RHEL 8 : thunderbird (RHSA-2025:10166)	Nessus	Red Hat Local Security Checks	critical
241113	RHEL 9 : thunderbird (RHSA-2025:10161)	Nessus	Red Hat Local Security Checks	critical
240907	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : MozillaThunderbird (SUSE-SU-2025:02158-1)	Nessus	SuSE Local Security Checks	medium
240447	Amazon Linux 2 : thunderbird (ALAS-2025-2896)	Nessus	Amazon Linux Local Security Checks	medium
240089	Fedora 41 : thunderbird (2025-883496c803)	Nessus	Fedora Local Security Checks	medium
238373	Fedora 42 : thunderbird (2025-1ac9269cc4)	Nessus	Fedora Local Security Checks	medium
238260	Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2025-162-01)	Nessus	Slackware Local Security Checks	medium
238109	Mozilla Thunderbird < 128.11.1	Nessus	Windows	medium
238108	Mozilla Thunderbird < 128.11.1	Nessus	MacOS X Local Security Checks	medium
238107	Mozilla Thunderbird < 139.0.2	Nessus	Windows	medium
238106	Mozilla Thunderbird < 139.0.2	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2025-5986

medium

Tenable Plugins

critical

critical

critical

medium

medium

medium

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium