Is CVE-2025-3909 actively exploited?

No active exploitation of CVE-2025-3909 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-3909 be exploited remotely?

Yes. CVE-2025-3909 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-3909?

CVE-2025-3909 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2025-3909

HIGH

CVE-2025-3909

CWE-356Published: May 14, 2025· Updated: Jun 17, 2026

8.1

CVSS v3.1

Official Description

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment (message/rfc822) and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened, allowing the embedded JavaScript to run without requiring a file download. This behavior relies on Thunderbird auto-saving the attachment to /tmp and linking to it via the file:/// protocol, potentially enabling JavaScript execution as part of the HTML. This vulnerability was fixed in Thunderbird 128.10.1 and Thunderbird 138.0.1.

NVD Source

Technical Analysis

CVE-2025-3909 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 8.1.