CVE-2025-3875

Sender Spoofing via Malformed From Header in Thunderbird

CVE-2025-3875 is fixed in 139 products on 2 platforms, first by Mozilla Thunderbird ESR (af) 128.10.0, released April 29, 2025. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.8
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0040
34th percentile

Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Mozilla Thunderbird (af) 138.0.1 Mozilla Thunderbird (af) 138.0.1 May 13, 2025
Mozilla Thunderbird (ar) 138.0.1 Mozilla Thunderbird (ar) 138.0.1 May 13, 2025
Mozilla Thunderbird (ast) 138.0.1 Mozilla Thunderbird (ast) 138.0.1 May 13, 2025
Mozilla Thunderbird (be) 138.0.1 Mozilla Thunderbird (be) 138.0.1 May 13, 2025
Mozilla Thunderbird (bg) 138.0.1 Mozilla Thunderbird (bg) 138.0.1 May 13, 2025
Mozilla Thunderbird (br) 138.0.1 Mozilla Thunderbird (br) 138.0.1 May 13, 2025
Mozilla Thunderbird (ca) 138.0.1 Mozilla Thunderbird (ca) 138.0.1 May 13, 2025
Mozilla Thunderbird (cak) 138.0.1 Mozilla Thunderbird (cak) 138.0.1 May 13, 2025
Mozilla Thunderbird (cs) 138.0.1 Mozilla Thunderbird (cs) 138.0.1 May 13, 2025
Mozilla Thunderbird (cy) 138.0.1 Mozilla Thunderbird (cy) 138.0.1 May 13, 2025
Mozilla Thunderbird (da) 138.0.1 Mozilla Thunderbird (da) 138.0.1 May 13, 2025
Mozilla Thunderbird (de) 138.0.1 Mozilla Thunderbird (de) 138.0.1 May 13, 2025
Mozilla Thunderbird (dsb) 138.0.1 Mozilla Thunderbird (dsb) 138.0.1 May 13, 2025
Mozilla Thunderbird (el) 138.0.1 Mozilla Thunderbird (el) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-CA) 138.0.1 Mozilla Thunderbird (en-CA) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-GB) 138.0.1 Mozilla Thunderbird (en-GB) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-US) 138.0.1 Mozilla Thunderbird (en-US) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-AR) 138.0.1 Mozilla Thunderbird (es-AR) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-ES) 138.0.1 Mozilla Thunderbird (es-ES) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-MX) 138.0.1 Mozilla Thunderbird (es-MX) 138.0.1 May 13, 2025
Mozilla Thunderbird (et) 138.0.1 Mozilla Thunderbird (et) 138.0.1 May 13, 2025
Mozilla Thunderbird (eu) 138.0.1 Mozilla Thunderbird (eu) 138.0.1 May 13, 2025
Mozilla Thunderbird (fi) 138.0.1 Mozilla Thunderbird (fi) 138.0.1 May 13, 2025
Mozilla Thunderbird (fr) 138.0.1 Mozilla Thunderbird (fr) 138.0.1 May 13, 2025
Mozilla Thunderbird (fy-NL) 138.0.1 Mozilla Thunderbird (fy-NL) 138.0.1 May 13, 2025
Mozilla Thunderbird (ga-IE) 138.0.1 Mozilla Thunderbird (ga-IE) 138.0.1 May 13, 2025
Mozilla Thunderbird (gd) 138.0.1 Mozilla Thunderbird (gd) 138.0.1 May 13, 2025
Mozilla Thunderbird (gl) 138.0.1 Mozilla Thunderbird (gl) 138.0.1 May 13, 2025
Mozilla Thunderbird (he) 138.0.1 Mozilla Thunderbird (he) 138.0.1 May 13, 2025
Mozilla Thunderbird (hr) 138.0.1 Mozilla Thunderbird (hr) 138.0.1 May 13, 2025
Mozilla Thunderbird (hsb) 138.0.1 Mozilla Thunderbird (hsb) 138.0.1 May 13, 2025
Mozilla Thunderbird (hu) 138.0.1 Mozilla Thunderbird (hu) 138.0.1 May 13, 2025
Mozilla Thunderbird (hy-AM) 138.0.1 Mozilla Thunderbird (hy-AM) 138.0.1 May 13, 2025
Mozilla Thunderbird (id) 138.0.1 Mozilla Thunderbird (id) 138.0.1 May 13, 2025
Mozilla Thunderbird (is) 138.0.1 Mozilla Thunderbird (is) 138.0.1 May 13, 2025
Mozilla Thunderbird (it) 138.0.1 Mozilla Thunderbird (it) 138.0.1 May 13, 2025
Mozilla Thunderbird (ja) 138.0.1 Mozilla Thunderbird (ja) 138.0.1 May 13, 2025
Mozilla Thunderbird (ka) 138.0.1 Mozilla Thunderbird (ka) 138.0.1 May 13, 2025
Mozilla Thunderbird (kab) 138.0.1 Mozilla Thunderbird (kab) 138.0.1 May 13, 2025
Mozilla Thunderbird (kk) 138.0.1 Mozilla Thunderbird (kk) 138.0.1 May 13, 2025
Mozilla Thunderbird (ko) 138.0.1 Mozilla Thunderbird (ko) 138.0.1 May 13, 2025
Mozilla Thunderbird (lt) 138.0.1 Mozilla Thunderbird (lt) 138.0.1 May 13, 2025
Mozilla Thunderbird (lv) 138.0.1 Mozilla Thunderbird (lv) 138.0.1 May 13, 2025
Mozilla Thunderbird (ms) 138.0.1 Mozilla Thunderbird (ms) 138.0.1 May 13, 2025
Mozilla Thunderbird (nb-NO) 138.0.1 Mozilla Thunderbird (nb-NO) 138.0.1 May 13, 2025
Mozilla Thunderbird (nl) 138.0.1 Mozilla Thunderbird (nl) 138.0.1 May 13, 2025
Mozilla Thunderbird (nn-NO) 138.0.1 Mozilla Thunderbird (nn-NO) 138.0.1 May 13, 2025
Mozilla Thunderbird (pa-IN) 138.0.1 Mozilla Thunderbird (pa-IN) 138.0.1 May 13, 2025
Mozilla Thunderbird (pl) 138.0.1 Mozilla Thunderbird (pl) 138.0.1 May 13, 2025
Mozilla Thunderbird (pt-BR) 138.0.1 Mozilla Thunderbird (pt-BR) 138.0.1 May 13, 2025
Mozilla Thunderbird (pt-PT) 138.0.1 Mozilla Thunderbird (pt-PT) 138.0.1 May 13, 2025
Mozilla Thunderbird (rm) 138.0.1 Mozilla Thunderbird (rm) 138.0.1 May 13, 2025
Mozilla Thunderbird (ro) 138.0.1 Mozilla Thunderbird (ro) 138.0.1 May 13, 2025
Mozilla Thunderbird (ru) 138.0.1 Mozilla Thunderbird (ru) 138.0.1 May 13, 2025
Mozilla Thunderbird (sk) 138.0.1 Mozilla Thunderbird (sk) 138.0.1 May 13, 2025
Mozilla Thunderbird (sl) 138.0.1 Mozilla Thunderbird (sl) 138.0.1 May 13, 2025
Mozilla Thunderbird (sq) 138.0.1 Mozilla Thunderbird (sq) 138.0.1 May 13, 2025
Mozilla Thunderbird (sr) 138.0.1 Mozilla Thunderbird (sr) 138.0.1 May 13, 2025
Mozilla Thunderbird (sv-SE) 138.0.1 Mozilla Thunderbird (sv-SE) 138.0.1 May 13, 2025
Mozilla Thunderbird (th) 138.0.1 Mozilla Thunderbird (th) 138.0.1 May 13, 2025
Mozilla Thunderbird (tr) 138.0.1 Mozilla Thunderbird (tr) 138.0.1 May 13, 2025
Mozilla Thunderbird (uk) 138.0.1 Mozilla Thunderbird (uk) 138.0.1 May 13, 2025
Mozilla Thunderbird (uz) 138.0.1 Mozilla Thunderbird (uz) 138.0.1 May 13, 2025
Mozilla Thunderbird (vi) 138.0.1 Mozilla Thunderbird (vi) 138.0.1 May 13, 2025
Mozilla Thunderbird (zh-CN) 138.0.1 Mozilla Thunderbird (zh-CN) 138.0.1 May 13, 2025
Mozilla Thunderbird (zh-TW) 138.0.1 Mozilla Thunderbird (zh-TW) 138.0.1 May 13, 2025
Mozilla Thunderbird ESR (af) 128.10.0 Mozilla Thunderbird ESR (af) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ar) 128.10.0 Mozilla Thunderbird ESR (ar) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ast) 128.10.0 Mozilla Thunderbird ESR (ast) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (be) 128.10.0 Mozilla Thunderbird ESR (be) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (bg) 128.10.0 Mozilla Thunderbird ESR (bg) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (br) 128.10.0 Mozilla Thunderbird ESR (br) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ca) 128.10.0 Mozilla Thunderbird ESR (ca) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (cak) 128.10.0 Mozilla Thunderbird ESR (cak) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (cs) 128.10.0 Mozilla Thunderbird ESR (cs) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (cy) 128.10.0 Mozilla Thunderbird ESR (cy) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (da) 128.10.0 Mozilla Thunderbird ESR (da) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (de) 128.10.0 Mozilla Thunderbird ESR (de) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (dsb) 128.10.0 Mozilla Thunderbird ESR (dsb) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (el) 128.10.0 Mozilla Thunderbird ESR (el) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (en-CA) 128.10.0 Mozilla Thunderbird ESR (en-CA) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (en-GB) 128.10.0 Mozilla Thunderbird ESR (en-GB) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (en-US) 128.10.0 Mozilla Thunderbird ESR (en-US) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (es-AR) 128.10.0 Mozilla Thunderbird ESR (es-AR) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (es-ES) 128.10.0 Mozilla Thunderbird ESR (es-ES) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (es-MX) 128.10.0 Mozilla Thunderbird ESR (es-MX) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (et) 128.10.0 Mozilla Thunderbird ESR (et) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (eu) 128.10.0 Mozilla Thunderbird ESR (eu) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (fi) 128.10.0 Mozilla Thunderbird ESR (fi) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (fr) 128.10.0 Mozilla Thunderbird ESR (fr) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (fy-NL) 128.10.0 Mozilla Thunderbird ESR (fy-NL) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ga-IE) 128.10.0 Mozilla Thunderbird ESR (ga-IE) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (gd) 128.10.0 Mozilla Thunderbird ESR (gd) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (gl) 128.10.0 Mozilla Thunderbird ESR (gl) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (he) 128.10.0 Mozilla Thunderbird ESR (he) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (hr) 128.10.0 Mozilla Thunderbird ESR (hr) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (hsb) 128.10.0 Mozilla Thunderbird ESR (hsb) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (hu) 128.10.0 Mozilla Thunderbird ESR (hu) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (hy-AM) 128.10.0 Mozilla Thunderbird ESR (hy-AM) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (id) 128.10.0 Mozilla Thunderbird ESR (id) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (is) 128.10.0 Mozilla Thunderbird ESR (is) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (it) 128.10.0 Mozilla Thunderbird ESR (it) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ja) 128.10.0 Mozilla Thunderbird ESR (ja) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ka) 128.10.0 Mozilla Thunderbird ESR (ka) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (kab) 128.10.0 Mozilla Thunderbird ESR (kab) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (kk) 128.10.0 Mozilla Thunderbird ESR (kk) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ko) 128.10.0 Mozilla Thunderbird ESR (ko) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (lt) 128.10.0 Mozilla Thunderbird ESR (lt) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (lv) 128.10.0 Mozilla Thunderbird ESR (lv) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ms) 128.10.0 Mozilla Thunderbird ESR (ms) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (nb-NO) 128.10.0 Mozilla Thunderbird ESR (nb-NO) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (nl) 128.10.0 Mozilla Thunderbird ESR (nl) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (nn-NO) 128.10.0 Mozilla Thunderbird ESR (nn-NO) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (pa-IN) 128.10.0 Mozilla Thunderbird ESR (pa-IN) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (pl) 128.10.0 Mozilla Thunderbird ESR (pl) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (pt-BR) 128.10.0 Mozilla Thunderbird ESR (pt-BR) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (pt-PT) 128.10.0 Mozilla Thunderbird ESR (pt-PT) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (rm) 128.10.0 Mozilla Thunderbird ESR (rm) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ro) 128.10.0 Mozilla Thunderbird ESR (ro) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (ru) 128.10.0 Mozilla Thunderbird ESR (ru) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (sk) 128.10.0 Mozilla Thunderbird ESR (sk) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (sl) 128.10.0 Mozilla Thunderbird ESR (sl) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (sq) 128.10.0 Mozilla Thunderbird ESR (sq) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (sr) 128.10.0 Mozilla Thunderbird ESR (sr) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (sv-SE) 128.10.0 Mozilla Thunderbird ESR (sv-SE) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (th) 128.10.0 Mozilla Thunderbird ESR (th) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (tr) 128.10.0 Mozilla Thunderbird ESR (tr) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (uk) 128.10.0 Mozilla Thunderbird ESR (uk) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (uz) 128.10.0 Mozilla Thunderbird ESR (uz) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (vi) 128.10.0 Mozilla Thunderbird ESR (vi) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (zh-CN) 128.10.0 Mozilla Thunderbird ESR (zh-CN) 128.10.0 Apr 29, 2025
Mozilla Thunderbird ESR (zh-TW) 128.10.0 Mozilla Thunderbird ESR (zh-TW) 128.10.0 Apr 29, 2025
Linux
MozillaThunderbird · opensuse-leap 15.6 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-1 May 22, 2025
MozillaThunderbird · sles 15.6 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-1 May 22, 2025
MozillaThunderbird · sles 15.7 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-2 May 29, 2025
thunderbird · Debian 12.15 (bookworm) 1:128.10.1esr-1~deb12u1 DSA-5921-1 May 16, 2025
thunderbird · Debian 13.5 (trixie) 1:128.10.1esr-1 DEBIAN-CVE-2025-3875 May 14, 2025
thunderbird · Debian 14 1:128.10.1esr-1 DEBIAN-CVE-2025-3875 May 14, 2025
thunderbird · RHEL 10 128.10.1-1.el10_0 RHSA-2025:8196 May 14, 2025
thunderbird · RHEL 8 0:128.11.0-1.el8_10 RHSA-2025:8756 Jun 10, 2025
thunderbird · RHEL 9 0:128.10.1-1.el9_6 RHSA-2025:8203 May 27, 2025
thunderbird · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
thunderbird · almalinux 10 128.10.1-1.el10_0.alma.1 ALSA-2025:8196 May 27, 2025
thunderbird · almalinux 8 128.11.0-1.el8_10.alma.1 ALSA-2025:8756 Jun 10, 2025
thunderbird · ol 10 0:128.11.0-1.0.1.el10_0 ELSA-2025-8196 Jun 30, 2025
thunderbird · ol 8 0:128.11.0-1.0.1.el8_10 ELSA-2025-8756 Jun 10, 2025
thunderbird · ol 9 0:128.10.1-1.0.1.el9_6 ELSA-2025-8203 May 27, 2025
thunderbird · rocky 10 0:128.10.1-1.el10_0 RLSA-2025:8196 Oct 3, 2025
thunderbird · rocky 8 0:128.11.0-1.el8_10 RLSA-2025:8756 Jul 29, 2025
thunderbird · rocky 9 0:128.10.1-1.el9_6 RLSA-2025:8203 Oct 4, 2025
thunderbird-gnome-support · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird-gnome-support 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
thunderbird-mozsymbols · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird-mozsymbols 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-calendar-timezones · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-calendar-timezones 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-gdata-provider · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-gdata-provider 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-lightning · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-lightning 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.