Cyber Resilience

CVE-2025-3523

Medium

Published: 15 April 2025

Published
15 April 2025
Modified
13 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
EPSS Score 0.0011 28.2th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-3523 is a medium-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Mozilla Thunderbird. Its CVSS base score is 6.4 (Medium).

Operationally, ranked at the 28.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into…

more

downloading content from untrusted sources. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

CWE(s)
CWE-451

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mozilla
thunderbird
≤ 128.9.2 · 129.0 — 137.0.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References