CVE-2025-5986 Overview
CVE-2025-5986 affects Mozilla Thunderbird and allows crafted HTML emails to trigger automatic downloads and external content loading through mailbox:/// links. When a user views a malicious email in HTML mode, external resources load automatically and .pdf file downloads can be delivered to the desktop or home directory without user consent prompts. Attackers can abuse this behavior to exhaust disk space with garbage data sourced from /dev/urandom on Linux or leak Windows credentials through Server Message Block (SMB) links. Visual obfuscation can further conceal the download trigger from the recipient. Mozilla resolved the issue in Thunderbird 128.11.1 and Thunderbird 139.0.2.
Critical Impact
Attackers can fill victim disks with arbitrary data or capture NTLM credentials over SMB by delivering a single crafted HTML email.
Affected Products
- Mozilla Thunderbird versions prior to 128.11.1 (ESR)
- Mozilla Thunderbird versions prior to 139.0.2
- Linux, Windows, and macOS builds of the affected Thunderbird releases
Discovery Timeline
- 2025-06-11 - CVE-2025-5986 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5986
Vulnerability Analysis
The flaw stems from Thunderbird's handling of the mailbox:/// Uniform Resource Identifier (URI) scheme inside HTML-rendered messages. Rendering an email in HTML mode causes Thunderbird to resolve embedded references to mailbox:/// targets, which in turn triggers file writes and external content loads that should require user confirmation.
Mozilla classifies this issue under [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. The email client does not clearly present the download action to the user, and existing auto-save protections are bypassed. Although the initial .pdf download requires a click, adversaries can obscure the click target using CSS or transparent overlays.
The vulnerability also enables Windows credential theft. When Thunderbird follows an SMB Uniform Naming Convention (UNC) path embedded in HTML, Windows attempts NTLM authentication against the attacker-controlled host, exposing user hashes.
Root Cause
Thunderbird's HTML rendering pipeline processes mailbox:/// URIs without enforcing the same user-interaction gates applied to standard file downloads. The client trusts the URI scheme to originate from local mail store operations rather than untrusted remote content embedded in a message body.
Attack Vector
An attacker sends a crafted HTML email containing mailbox:/// references and remote SMB links. When the victim opens the message in HTML mode, Thunderbird loads external content automatically. A single obscured click, or the mere act of viewing, is sufficient to write attacker-controlled files to the local file system or leak SMB authentication material. See the Mozilla Security Advisory MFSA-2025-49 and Mozilla Security Advisory MFSA-2025-50 for vendor-supplied details.
Detection Methods for CVE-2025-5986
Indicators of Compromise
- Unexpected .pdf files appearing on user desktops or home directories with high-entropy or random content, particularly large files sourced from /dev/urandom on Linux hosts.
- Outbound SMB traffic from workstations to untrusted external IP addresses immediately after Thunderbird opens a message.
- Thunderbird process activity spawning file writes to user profile directories without a corresponding save dialog interaction.
Detection Strategies
- Monitor endpoint file-creation telemetry for thunderbird.exe or thunderbird-bin writing .pdf files outside the mail profile directory.
- Alert on NTLM authentication attempts leaving the network over TCP/445 or TCP/139, especially where the initiating process is the mail client.
- Correlate email delivery logs with subsequent disk-usage spikes on the recipient endpoint to catch storage exhaustion attempts.
Monitoring Recommendations
- Deploy egress filtering rules that block outbound SMB (TCP/139, TCP/445) at the perimeter and log any attempts.
- Track Thunderbird version inventory across managed endpoints and flag hosts running builds prior to 128.11.1 or 139.0.2.
- Review mail gateway logs for messages containing mailbox:/// or file:// URI schemes and SMB UNC paths in HTML bodies.
How to Mitigate CVE-2025-5986
Immediate Actions Required
- Upgrade Thunderbird to version 128.11.1 (ESR channel) or 139.0.2 or later on every managed endpoint.
- Switch Thunderbird's default message display to plain text until the patch is deployed across the fleet.
- Block outbound SMB traffic at the network boundary to neutralize credential-leak attempts even if a vulnerable client is exploited.
Patch Information
Mozilla released fixes in Thunderbird 128.11.1 and Thunderbird 139.0.2. Details are published in MFSA-2025-49 and MFSA-2025-50. Debian users should apply the update described in the Debian LTS Announcement. Related bug reports are tracked in the Mozilla Bug List.
Workarounds
- Disable HTML message rendering by setting View > Message Body As > Plain Text in Thunderbird.
- Set network.protocol-handler.external.mailbox and related preferences to false in about:config to restrict handling of mailbox:/// links.
- Enforce Group Policy or registry settings on Windows that prevent NTLM authentication to remote servers outside trusted zones.
# Configuration example: disable HTML rendering via Thunderbird user.js
echo 'user_pref("mailnews.display.prefer_plaintext", true);' >> ~/.thunderbird/*.default*/user.js
echo 'user_pref("mailnews.display.html_as", 1);' >> ~/.thunderbird/*.default*/user.js
echo 'user_pref("mailnews.message_display.disable_remote_image", true);' >> ~/.thunderbird/*.default*/user.js
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
