A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability affects Thunderbird < 128.11.1 and Thunderbird < 139.0.2.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-1ac9269cc4 advisory.

    Update to 128.11.1

    * https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of mozilla-thunderbird installed on the remote host is prior to 128.11.1esr. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-162-01 advisory.

    New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues.

Tenable has extracted the preceding description block directly from the mozilla-thunderbird security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 128.11.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-49 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.11.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-49 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 139.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-50 advisory.

  - A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to     the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can     be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows     credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to     download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML     mode is enough to load external content. (CVE-2025-5986)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
238373	Fedora 42 : thunderbird (2025-1ac9269cc4)	Nessus	Fedora Local Security Checks	medium
238260	Slackware Linux 15.0 / current mozilla-thunderbird Vulnerability (SSA:2025-162-01)	Nessus	Slackware Local Security Checks	medium
238109	Mozilla Thunderbird < 128.11.1	Nessus	Windows	medium
238108	Mozilla Thunderbird < 128.11.1	Nessus	MacOS X Local Security Checks	medium
238107	Mozilla Thunderbird < 139.0.2	Nessus	Windows	medium
238106	Mozilla Thunderbird < 139.0.2	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2025-5986

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium