CVE-2025-3909

JavaScript Execution via Spoofed PDF Attachment and file:/// Link

CVE-2025-3909 is fixed in 139 products on 2 platforms, first by Mozilla Thunderbird (af) 138.0.1, released May 13, 2025. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.8
Important
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0047
40th percentile

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

Where it's fixed

ProductFixed inFixReleased
Windows apps
Mozilla Thunderbird (af) 138.0.1 Mozilla Thunderbird (af) 138.0.1 May 13, 2025
Mozilla Thunderbird (ar) 138.0.1 Mozilla Thunderbird (ar) 138.0.1 May 13, 2025
Mozilla Thunderbird (ast) 138.0.1 Mozilla Thunderbird (ast) 138.0.1 May 13, 2025
Mozilla Thunderbird (be) 138.0.1 Mozilla Thunderbird (be) 138.0.1 May 13, 2025
Mozilla Thunderbird (bg) 138.0.1 Mozilla Thunderbird (bg) 138.0.1 May 13, 2025
Mozilla Thunderbird (br) 138.0.1 Mozilla Thunderbird (br) 138.0.1 May 13, 2025
Mozilla Thunderbird (ca) 138.0.1 Mozilla Thunderbird (ca) 138.0.1 May 13, 2025
Mozilla Thunderbird (cak) 138.0.1 Mozilla Thunderbird (cak) 138.0.1 May 13, 2025
Mozilla Thunderbird (cs) 138.0.1 Mozilla Thunderbird (cs) 138.0.1 May 13, 2025
Mozilla Thunderbird (cy) 138.0.1 Mozilla Thunderbird (cy) 138.0.1 May 13, 2025
Mozilla Thunderbird (da) 138.0.1 Mozilla Thunderbird (da) 138.0.1 May 13, 2025
Mozilla Thunderbird (de) 138.0.1 Mozilla Thunderbird (de) 138.0.1 May 13, 2025
Mozilla Thunderbird (dsb) 138.0.1 Mozilla Thunderbird (dsb) 138.0.1 May 13, 2025
Mozilla Thunderbird (el) 138.0.1 Mozilla Thunderbird (el) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-CA) 138.0.1 Mozilla Thunderbird (en-CA) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-GB) 138.0.1 Mozilla Thunderbird (en-GB) 138.0.1 May 13, 2025
Mozilla Thunderbird (en-US) 138.0.1 Mozilla Thunderbird (en-US) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-AR) 138.0.1 Mozilla Thunderbird (es-AR) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-ES) 138.0.1 Mozilla Thunderbird (es-ES) 138.0.1 May 13, 2025
Mozilla Thunderbird (es-MX) 138.0.1 Mozilla Thunderbird (es-MX) 138.0.1 May 13, 2025
Mozilla Thunderbird (et) 138.0.1 Mozilla Thunderbird (et) 138.0.1 May 13, 2025
Mozilla Thunderbird (eu) 138.0.1 Mozilla Thunderbird (eu) 138.0.1 May 13, 2025
Mozilla Thunderbird (fi) 138.0.1 Mozilla Thunderbird (fi) 138.0.1 May 13, 2025
Mozilla Thunderbird (fr) 138.0.1 Mozilla Thunderbird (fr) 138.0.1 May 13, 2025
Mozilla Thunderbird (fy-NL) 138.0.1 Mozilla Thunderbird (fy-NL) 138.0.1 May 13, 2025
Mozilla Thunderbird (ga-IE) 138.0.1 Mozilla Thunderbird (ga-IE) 138.0.1 May 13, 2025
Mozilla Thunderbird (gd) 138.0.1 Mozilla Thunderbird (gd) 138.0.1 May 13, 2025
Mozilla Thunderbird (gl) 138.0.1 Mozilla Thunderbird (gl) 138.0.1 May 13, 2025
Mozilla Thunderbird (he) 138.0.1 Mozilla Thunderbird (he) 138.0.1 May 13, 2025
Mozilla Thunderbird (hr) 138.0.1 Mozilla Thunderbird (hr) 138.0.1 May 13, 2025
Mozilla Thunderbird (hsb) 138.0.1 Mozilla Thunderbird (hsb) 138.0.1 May 13, 2025
Mozilla Thunderbird (hu) 138.0.1 Mozilla Thunderbird (hu) 138.0.1 May 13, 2025
Mozilla Thunderbird (hy-AM) 138.0.1 Mozilla Thunderbird (hy-AM) 138.0.1 May 13, 2025
Mozilla Thunderbird (id) 138.0.1 Mozilla Thunderbird (id) 138.0.1 May 13, 2025
Mozilla Thunderbird (is) 138.0.1 Mozilla Thunderbird (is) 138.0.1 May 13, 2025
Mozilla Thunderbird (it) 138.0.1 Mozilla Thunderbird (it) 138.0.1 May 13, 2025
Mozilla Thunderbird (ja) 138.0.1 Mozilla Thunderbird (ja) 138.0.1 May 13, 2025
Mozilla Thunderbird (ka) 138.0.1 Mozilla Thunderbird (ka) 138.0.1 May 13, 2025
Mozilla Thunderbird (kab) 138.0.1 Mozilla Thunderbird (kab) 138.0.1 May 13, 2025
Mozilla Thunderbird (kk) 138.0.1 Mozilla Thunderbird (kk) 138.0.1 May 13, 2025
Mozilla Thunderbird (ko) 138.0.1 Mozilla Thunderbird (ko) 138.0.1 May 13, 2025
Mozilla Thunderbird (lt) 138.0.1 Mozilla Thunderbird (lt) 138.0.1 May 13, 2025
Mozilla Thunderbird (lv) 138.0.1 Mozilla Thunderbird (lv) 138.0.1 May 13, 2025
Mozilla Thunderbird (ms) 138.0.1 Mozilla Thunderbird (ms) 138.0.1 May 13, 2025
Mozilla Thunderbird (nb-NO) 138.0.1 Mozilla Thunderbird (nb-NO) 138.0.1 May 13, 2025
Mozilla Thunderbird (nl) 138.0.1 Mozilla Thunderbird (nl) 138.0.1 May 13, 2025
Mozilla Thunderbird (nn-NO) 138.0.1 Mozilla Thunderbird (nn-NO) 138.0.1 May 13, 2025
Mozilla Thunderbird (pa-IN) 138.0.1 Mozilla Thunderbird (pa-IN) 138.0.1 May 13, 2025
Mozilla Thunderbird (pl) 138.0.1 Mozilla Thunderbird (pl) 138.0.1 May 13, 2025
Mozilla Thunderbird (pt-BR) 138.0.1 Mozilla Thunderbird (pt-BR) 138.0.1 May 13, 2025
Mozilla Thunderbird (pt-PT) 138.0.1 Mozilla Thunderbird (pt-PT) 138.0.1 May 13, 2025
Mozilla Thunderbird (rm) 138.0.1 Mozilla Thunderbird (rm) 138.0.1 May 13, 2025
Mozilla Thunderbird (ro) 138.0.1 Mozilla Thunderbird (ro) 138.0.1 May 13, 2025
Mozilla Thunderbird (ru) 138.0.1 Mozilla Thunderbird (ru) 138.0.1 May 13, 2025
Mozilla Thunderbird (sk) 138.0.1 Mozilla Thunderbird (sk) 138.0.1 May 13, 2025
Mozilla Thunderbird (sl) 138.0.1 Mozilla Thunderbird (sl) 138.0.1 May 13, 2025
Mozilla Thunderbird (sq) 138.0.1 Mozilla Thunderbird (sq) 138.0.1 May 13, 2025
Mozilla Thunderbird (sr) 138.0.1 Mozilla Thunderbird (sr) 138.0.1 May 13, 2025
Mozilla Thunderbird (sv-SE) 138.0.1 Mozilla Thunderbird (sv-SE) 138.0.1 May 13, 2025
Mozilla Thunderbird (th) 138.0.1 Mozilla Thunderbird (th) 138.0.1 May 13, 2025
Mozilla Thunderbird (tr) 138.0.1 Mozilla Thunderbird (tr) 138.0.1 May 13, 2025
Mozilla Thunderbird (uk) 138.0.1 Mozilla Thunderbird (uk) 138.0.1 May 13, 2025
Mozilla Thunderbird (uz) 138.0.1 Mozilla Thunderbird (uz) 138.0.1 May 13, 2025
Mozilla Thunderbird (vi) 138.0.1 Mozilla Thunderbird (vi) 138.0.1 May 13, 2025
Mozilla Thunderbird (zh-CN) 138.0.1 Mozilla Thunderbird (zh-CN) 138.0.1 May 13, 2025
Mozilla Thunderbird (zh-TW) 138.0.1 Mozilla Thunderbird (zh-TW) 138.0.1 May 13, 2025
Mozilla Thunderbird ESR (af) 128.10.1 Mozilla Thunderbird ESR (af) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ar) 128.10.1 Mozilla Thunderbird ESR (ar) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ast) 128.10.1 Mozilla Thunderbird ESR (ast) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (be) 128.10.1 Mozilla Thunderbird ESR (be) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (bg) 128.10.1 Mozilla Thunderbird ESR (bg) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (br) 128.10.1 Mozilla Thunderbird ESR (br) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ca) 128.10.1 Mozilla Thunderbird ESR (ca) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (cak) 128.10.1 Mozilla Thunderbird ESR (cak) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (cs) 128.10.1 Mozilla Thunderbird ESR (cs) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (cy) 128.10.1 Mozilla Thunderbird ESR (cy) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (da) 128.10.1 Mozilla Thunderbird ESR (da) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (de) 128.10.1 Mozilla Thunderbird ESR (de) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (dsb) 128.10.1 Mozilla Thunderbird ESR (dsb) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (el) 128.10.1 Mozilla Thunderbird ESR (el) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (en-CA) 128.10.1 Mozilla Thunderbird ESR (en-CA) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (en-GB) 128.10.1 Mozilla Thunderbird ESR (en-GB) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (en-US) 128.10.1 Mozilla Thunderbird ESR (en-US) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (es-AR) 128.10.1 Mozilla Thunderbird ESR (es-AR) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (es-ES) 128.10.1 Mozilla Thunderbird ESR (es-ES) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (es-MX) 128.10.1 Mozilla Thunderbird ESR (es-MX) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (et) 128.10.1 Mozilla Thunderbird ESR (et) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (eu) 128.10.1 Mozilla Thunderbird ESR (eu) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (fi) 128.10.1 Mozilla Thunderbird ESR (fi) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (fr) 128.10.1 Mozilla Thunderbird ESR (fr) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (fy-NL) 128.10.1 Mozilla Thunderbird ESR (fy-NL) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ga-IE) 128.10.1 Mozilla Thunderbird ESR (ga-IE) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (gd) 128.10.1 Mozilla Thunderbird ESR (gd) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (gl) 128.10.1 Mozilla Thunderbird ESR (gl) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (he) 128.10.1 Mozilla Thunderbird ESR (he) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (hr) 128.10.1 Mozilla Thunderbird ESR (hr) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (hsb) 128.10.1 Mozilla Thunderbird ESR (hsb) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (hu) 128.10.1 Mozilla Thunderbird ESR (hu) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (hy-AM) 128.10.1 Mozilla Thunderbird ESR (hy-AM) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (id) 128.10.1 Mozilla Thunderbird ESR (id) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (is) 128.10.1 Mozilla Thunderbird ESR (is) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (it) 128.10.1 Mozilla Thunderbird ESR (it) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ja) 128.10.1 Mozilla Thunderbird ESR (ja) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ka) 128.10.1 Mozilla Thunderbird ESR (ka) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (kab) 128.10.1 Mozilla Thunderbird ESR (kab) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (kk) 128.10.1 Mozilla Thunderbird ESR (kk) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ko) 128.10.1 Mozilla Thunderbird ESR (ko) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (lt) 128.10.1 Mozilla Thunderbird ESR (lt) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (lv) 128.10.1 Mozilla Thunderbird ESR (lv) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ms) 128.10.1 Mozilla Thunderbird ESR (ms) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (nb-NO) 128.10.1 Mozilla Thunderbird ESR (nb-NO) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (nl) 128.10.1 Mozilla Thunderbird ESR (nl) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (nn-NO) 128.10.1 Mozilla Thunderbird ESR (nn-NO) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (pa-IN) 128.10.1 Mozilla Thunderbird ESR (pa-IN) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (pl) 128.10.1 Mozilla Thunderbird ESR (pl) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (pt-BR) 128.10.1 Mozilla Thunderbird ESR (pt-BR) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (pt-PT) 128.10.1 Mozilla Thunderbird ESR (pt-PT) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (rm) 128.10.1 Mozilla Thunderbird ESR (rm) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ro) 128.10.1 Mozilla Thunderbird ESR (ro) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (ru) 128.10.1 Mozilla Thunderbird ESR (ru) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (sk) 128.10.1 Mozilla Thunderbird ESR (sk) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (sl) 128.10.1 Mozilla Thunderbird ESR (sl) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (sq) 128.10.1 Mozilla Thunderbird ESR (sq) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (sr) 128.10.1 Mozilla Thunderbird ESR (sr) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (sv-SE) 128.10.1 Mozilla Thunderbird ESR (sv-SE) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (th) 128.10.1 Mozilla Thunderbird ESR (th) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (tr) 128.10.1 Mozilla Thunderbird ESR (tr) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (uk) 128.10.1 Mozilla Thunderbird ESR (uk) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (uz) 128.10.1 Mozilla Thunderbird ESR (uz) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (vi) 128.10.1 Mozilla Thunderbird ESR (vi) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (zh-CN) 128.10.1 Mozilla Thunderbird ESR (zh-CN) 128.10.1 May 14, 2025
Mozilla Thunderbird ESR (zh-TW) 128.10.1 Mozilla Thunderbird ESR (zh-TW) 128.10.1 May 14, 2025
Linux
MozillaThunderbird · opensuse-leap 15.6 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-1 May 22, 2025
MozillaThunderbird · sles 15.6 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-1 May 22, 2025
MozillaThunderbird · sles 15.7 128.10.1-150200.8.215.1 SUSE-SU-2025:01660-2 May 29, 2025
thunderbird · Debian 12.15 (bookworm) 1:128.10.1esr-1~deb12u1 DEBIAN-CVE-2025-3909 May 14, 2025
thunderbird · Debian 13.5 (trixie) 1:128.10.1esr-1 DEBIAN-CVE-2025-3909 May 14, 2025
thunderbird · Debian 14 1:128.10.1esr-1 DEBIAN-CVE-2025-3909 May 14, 2025
thunderbird · RHEL 10 128.10.1-1.el10_0 RHSA-2025:8196 May 14, 2025
thunderbird · RHEL 8 0:128.11.0-1.el8_10 RHSA-2025:8756 Jun 10, 2025
thunderbird · RHEL 9 0:128.10.1-1.el9_6 RHSA-2025:8203 May 27, 2025
thunderbird · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
thunderbird · almalinux 10 128.10.1-1.el10_0.alma.1 ALSA-2025:8196 May 27, 2025
thunderbird · almalinux 8 128.11.0-1.el8_10.alma.1 ALSA-2025:8756 Jun 10, 2025
thunderbird · ol 10 0:128.11.0-1.0.1.el10_0 ELSA-2025-8196 Jun 30, 2025
thunderbird · ol 8 0:128.11.0-1.0.1.el8_10 ELSA-2025-8756 Jun 10, 2025
thunderbird · ol 9 0:128.10.1-1.0.1.el9_6 ELSA-2025-8203 May 27, 2025
thunderbird · rocky 10 0:128.10.1-1.el10_0 RLSA-2025:8196 Oct 3, 2025
thunderbird · rocky 8 0:128.11.0-1.el8_10 RLSA-2025:8756 Jul 29, 2025
thunderbird · rocky 9 0:128.10.1-1.el9_6 RLSA-2025:8203 Oct 4, 2025
thunderbird-gnome-support · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird-gnome-support 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
thunderbird-mozsymbols · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 thunderbird-mozsymbols 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-calendar-timezones · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-calendar-timezones 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-gdata-provider · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-gdata-provider 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025
xul-ext-lightning · Ubuntu 22.04.1 LTS (jammy) 1:128.12.0+build1-0ubuntu0.22.04.1 xul-ext-lightning 1:128.12.0+build1-0ubuntu0.22.04.1 Jun 24, 2025

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.