CVE-2025-3909: Mozilla Thunderbird RCE Vulnerability

CVE-2025-3909 Overview

CVE-2025-3909 is a high-severity vulnerability in Mozilla Thunderbird that allows attackers to execute JavaScript in the file:/// context through crafted email attachments. The flaw resides in how Thunderbird processes the X-Mozilla-External-Attachment-URL header. By embedding a nested message/rfc822 attachment with a content type of application/pdf, an attacker can trick Thunderbird into rendering the payload as HTML when opened. Thunderbird auto-saves the attachment to /tmp and links to it via the file:/// protocol, enabling embedded JavaScript to execute without an explicit download. Mozilla fixed the issue in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Critical Impact
Successful exploitation enables arbitrary JavaScript execution in the local file context, exposing local files and user data to remote attackers via a single crafted email.

Affected Products

Mozilla Thunderbird versions prior to 128.10.1 (ESR branch)
Mozilla Thunderbird versions prior to 138.0.1 (release branch)
Debian LTS distributions packaging affected Thunderbird builds

Discovery Timeline

2025-05-14 - CVE-2025-3909 published to NVD
2026-04-13 - Last updated in NVD database

Technical Details for CVE-2025-3909

Vulnerability Analysis

The vulnerability is categorized under [CWE-356] Product UI Does Not Warn User of Unsafe Actions. Thunderbird incorrectly processes nested email attachments carrying a message/rfc822 MIME wrapper while declaring an inner content type of application/pdf. Rather than honoring the declared PDF type, Thunderbird renders the attachment content as HTML when the user opens it. Because Thunderbird auto-saves external attachments to /tmp and references them through the file:/// URL scheme, any JavaScript embedded in the HTML executes within the local file origin. This origin historically receives elevated trust compared to remote web origins, granting access to other local resources.

Root Cause

The root cause lies in inconsistent MIME type handling for attachments referenced through the X-Mozilla-External-Attachment-URL header. Thunderbird trusts the outer wrapper for storage logic but applies HTML rendering based on the file extension or content sniffing. The mismatch between declared content type and actual rendering behavior creates the unsafe execution path. The auto-save behavior compounds the issue by establishing a file:/// origin that the JavaScript engine treats as local.

Attack Vector

An attacker delivers a crafted email containing a nested message/rfc822 attachment with manipulated MIME headers. The user must open the attachment for exploitation to succeed. No additional download prompt is shown because Thunderbird silently writes the attachment to /tmp and opens it via file:///. The embedded JavaScript then executes in the local file context, where it can read other files accessible through file:/// URLs, exfiltrate data, or stage further actions against the local environment.

The vulnerability requires user interaction to trigger but does not require authentication or prior access. Refer to Mozilla Bug Report #1958376 for the underlying technical analysis.

Detection Methods for CVE-2025-3909

Indicators of Compromise

Emails containing nested message/rfc822 attachments with an inner Content-Type: application/pdf declaration combined with HTML payload content
Presence of unexpected X-Mozilla-External-Attachment-URL headers referencing files written into /tmp
Thunderbird process activity opening file:///tmp/ URLs immediately after attachment interaction
Outbound network requests originating from Thunderbird tied to recently opened attachments

Detection Strategies

Inspect mail gateway logs for messages with mismatched MIME structures, specifically message/rfc822 parts containing PDF declarations wrapping HTML or JavaScript content
Monitor endpoint telemetry for Thunderbird child processes accessing file:///tmp/ paths followed by JavaScript-driven file reads
Correlate attachment-open events with anomalous outbound HTTP or DNS requests from the Thunderbird process

Monitoring Recommendations

Enable verbose mail client logging on managed endpoints to capture attachment handling events
Forward email gateway MIME analysis results to a centralized SIEM for retroactive hunting
Track Thunderbird version inventory across the fleet to identify hosts still running pre-128.10.1 or pre-138.0.1 builds

How to Mitigate CVE-2025-3909

Immediate Actions Required

Upgrade Thunderbird to version 128.10.1 (ESR) or 138.0.1 (release) immediately across all managed endpoints
Apply distribution-specific updates such as the Debian LTS packages referenced in the Debian LTS Announcement May 2025
Audit /tmp directories on Linux hosts for unexpected attachment files written by Thunderbird
Notify users to avoid opening unsolicited PDF attachments until patching is complete

Patch Information

Mozilla released fixes in Thunderbird 128.10.1 and Thunderbird 138.0.1. Patch details are documented in Mozilla Security Advisory MFSA-2025-34 and Mozilla Security Advisory MFSA-2025-35. Both advisories address the unsafe rendering of nested message/rfc822 attachments by enforcing correct MIME handling and removing the file:/// execution path for auto-saved attachments.

Workarounds

Configure mail gateways to strip or quarantine emails containing nested message/rfc822 attachments with declared application/pdf content types
Disable automatic external attachment handling in Thunderbird preferences where feasible
Restrict Thunderbird's ability to write to world-readable temporary directories by adjusting host filesystem permissions or using sandboxing tools such as firejail

bash

# Configuration example
# Verify installed Thunderbird version on Linux endpoints
thunderbird --version

# Example Debian LTS upgrade command
sudo apt-get update && sudo apt-get install --only-upgrade thunderbird