CVE & CISA-KEV CatalogNVD
CVE-2025-5986
MEDIUM6.5
CVSS v3
Description
A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.
How to fix
Remediation Available
thunderbirdDebian
Fixed in:1:128.12.0esr-1~deb11u1CVE-2025-5986
Fixed in:1:128.12.0esr-1~deb12u1CVE-2025-5986
Fixed in:1:128.12.0esr-1CVE-2025-5986
Fixed in:1:128.12.0esr-1CVE-2025-5986
thunderbirdRed Hat / RHEL
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
thunderbirdRocky
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
thunderbird-debuginfoRed Hat / RHEL
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
thunderbird-debuginfoRocky
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
thunderbird-debugsourceRed Hat / RHEL
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
thunderbird-debugsourceRocky
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195
Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163
Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196
Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159
Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161
Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160
thunderbirdUbuntu
Fixed in:1:128.12.0+build1-0ubuntu0.22.04.1USN-7663-1
TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works
Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.
CVSS v3 Vector
Exploitability
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
Impact
ConfidentialityNone
IntegrityNone
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploit Intelligence
0.47%probability of exploitation in 30 days
37thpercentile
Low risk: more likely to be exploited than 37% of all known CVEs.
References
Vendor Advisory2
Other references2
Related Vulnerabilities
Other CWE-451 vulnerabilities, ordered by exploit likelihood. View all
| CVE | Severity | CVSS | EPSS | Exploited | Fix |
|---|---|---|---|---|---|
| CVE-2024-38112 | High | 7.5 | 84% | KEV | Fix |
| CVE-2025-9491 | High | 7.8 | 63% | - | - |
| CVE-2024-43461 | High | 8.8 | 52% | KEV | Fix |
| CVE-2024-38197 | Medium | 6.5 | 16% | - | - |
| CVE-2024-49040 | High | 7.5 | 7.7% | - | Fix |
| CVE-2026-21527 | High | 6.5 | 7.7% | - | Fix |
Embed a live status badge for CVE-2025-5986
Markdown
[](https://tridentstack.com/cve/CVE-2025-5986)HTML
<a href="https://tridentstack.com/cve/CVE-2025-5986"><img src="https://tridentstack.com/cve/badge/CVE-2025-5986.svg" alt="CVE-2025-5986"></a>Find and fix vulnerabilities across your fleet
TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.
This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-04-13.