CVE-2025-5986 — User Interface (UI) Misrepresentation of Critical Information in Mozilla Thunderbird
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 30.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateJul 22
Description
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
3OSV▶
CVE-2025-5986: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of↗2025-06-11
CVEList▶
Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links↗2025-06-11
GHSA▶
GHSA-q7fj-77gc-45xq: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of↗2025-06-11