VulnerabilityModified

CVE-2025-1015

This could be used by an attacker to create and export an address book containing a malicious payload in a field.

MEDIUM 5.4EPSS 1.37%

Does this matter?

Lower severity and a low EPSS score (1.37%). Track it; it rarely justifies an emergency change on its own.

Description

The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS: 1.37% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: mozilla/thunderbird
Source: security@mozilla.org

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1939458Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-11/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.