Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-3875

Date: May 14, 2025

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.

Severity Score

Related Resources (5)

https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
https://www.mozilla.org/security/advisories/mfsa2025-35/
https://www.mozilla.org/security/advisories/mfsa2025-34/
https://nvd.nist.gov/vuln/detail/CVE-2025-3875
https://www.mend.io/vulnerability-database/CVE-2025-3875

Severity Score

Weakness Type (CWE)

Authentication Bypass by Spoofing

CWE-290

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us