Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-4086

Specially crafted filename could be used to obscure download type

Description

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Mozilla Firefox

  • 138 to ≤ *unaffected

Mozilla Thunderbird

  • 138 to ≤ *unaffected

References