Summary
Mozilla Thunderbird is a standalone mail and newsgroup client.
Security Fix(es):
* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | thunderbird | 128.12.0-1.el9_6.alma.1 |
Vulnerabilities 1
-
Medium 6.5
Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data …