CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 6.4. See the original NVD description below for full technical details.
CVE
CVE-2025-3523
Severity
MEDIUM
CVSS
6.4
EPSS
0.30%
Original NVD Description
When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)