CVE-2025-4086

MediumCVSS 6.5

Published: 29/04/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

20th percentile - higher than 20% of all known CVEs

Summary

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Risk Assessment

Users may be tricked into downloading a malicious file with a hidden extension, potentially leading to the execution of dangerous software.

Recommendation

Update Thunderbird for Android to version 138 or later, which includes the fix. Be cautious when downloading files from unknown sources.

Other vulnerabilities in Thunderbird for Android

CVE-2025-4090Medium
A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Original NVD description (English source)

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS