Search for vulnerabilities
Vulnerability details: VCID-zfe6-zg3h-wbhy
Vulnerability ID VCID-zfe6-zg3h-wbhy
Aliases CVE-2025-3875
Summary Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-290 Authentication Bypass by Spoofing
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3875.json
epss 0.00017 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
epss 0.00041 https://api.first.org/data/v1/epss?cve=CVE-2025-3875
cvssv3.1 7.5 https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
ssvc Track https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-34
generic_textual high https://www.mozilla.org/en-US/security/advisories/mfsa2025-35
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-34/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-34/
cvssv3.1 7.5 https://www.mozilla.org/security/advisories/mfsa2025-35/
ssvc Track https://www.mozilla.org/security/advisories/mfsa2025-35/
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3875.json
https://api.first.org/data/v1/epss?cve=CVE-2025-3875
https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3875
https://www.mozilla.org/security/advisories/mfsa2025-34/
https://www.mozilla.org/security/advisories/mfsa2025-35/
2366287 https://bugzilla.redhat.com/show_bug.cgi?id=2366287
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVE-2025-3875 https://nvd.nist.gov/vuln/detail/CVE-2025-3875
mfsa2025-34 https://www.mozilla.org/en-US/security/advisories/mfsa2025-34
mfsa2025-35 https://www.mozilla.org/en-US/security/advisories/mfsa2025-35
RHSA-2025:8196 https://access.redhat.com/errata/RHSA-2025:8196
RHSA-2025:8203 https://access.redhat.com/errata/RHSA-2025:8203
RHSA-2025:8324 https://access.redhat.com/errata/RHSA-2025:8324
RHSA-2025:8325 https://access.redhat.com/errata/RHSA-2025:8325
RHSA-2025:8326 https://access.redhat.com/errata/RHSA-2025:8326
RHSA-2025:8391 https://access.redhat.com/errata/RHSA-2025:8391
RHSA-2025:8507 https://access.redhat.com/errata/RHSA-2025:8507
RHSA-2025:8594 https://access.redhat.com/errata/RHSA-2025:8594
RHSA-2025:8756 https://access.redhat.com/errata/RHSA-2025:8756
RHSA-2025:8784 https://access.redhat.com/errata/RHSA-2025:8784
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3875.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T14:52:16Z/ Found at https://bugzilla.mozilla.org/show_bug.cgi?id=1950629
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-34/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T14:52:16Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-34/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://www.mozilla.org/security/advisories/mfsa2025-35/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-15T14:52:16Z/ Found at https://www.mozilla.org/security/advisories/mfsa2025-35/
Exploit Prediction Scoring System (EPSS)
Percentile 0.02538
EPSS Score 0.00017
Published At May 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-05-14T21:39:26.574718+00:00 Mozilla Importer Import https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2025/mfsa2025-34.yml 36.0.0