Is CVE-2025-5986 in the CISA KEV catalog?

No. CVE-2025-5986 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-5986?

CVE-2025-5986 has a CVSS v3 base score of 6.5 (MEDIUM).

What is the EPSS score for CVE-2025-5986?

CVE-2025-5986 has an EPSS score of 0.47% (37th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-5986?

Upgrade thunderbird on debian 11 to 1:128.12.0esr-1~deb11u1 or later. Fixes are available for 9 affected products.

CVE & CISA-KEV Catalog

CVE-2025-5986

MEDIUM

6.5

CVSS v3

NVD

Description

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data (e.g. using /dev/urandom on Linux) or to leak Windows credentials via SMB links when the email is viewed in HTML mode. While user interaction is required to download the .pdf file, visual obfuscation can conceal the download trigger. Viewing the email in HTML mode is enough to load external content. This vulnerability was fixed in Thunderbird 128.11.1 and Thunderbird 139.0.2.

CWE-451

How to fix

Remediation Available

thunderbirdDebian

Fixed in:1:128.12.0esr-1~deb11u1CVE-2025-5986

Fixed in:1:128.12.0esr-1~deb12u1CVE-2025-5986

Fixed in:1:128.12.0esr-1CVE-2025-5986

thunderbirdRed Hat / RHEL

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

thunderbirdRocky

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

thunderbird-debuginfoRed Hat / RHEL

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

thunderbird-debuginfoRocky

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

thunderbird-debugsourceRed Hat / RHEL

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

thunderbird-debugsourceRocky

Fixed in:0:128.12.0-1.el10_0RHSA-2025:10195

Fixed in:0:128.12.0-1.el8_2RHSA-2025:10166

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el8_4RHSA-2025:10165

Fixed in:0:128.12.0-1.el8_8RHSA-2025:10163

Fixed in:0:128.12.0-1.el8_6RHSA-2025:10164

Fixed in:0:128.12.0-1.el8_10RHSA-2025:10246

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

Fixed in:0:128.12.0-1.el9_4RHSA-2025:10159

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_0RHSA-2025:10161

Fixed in:0:128.12.0-1.el9_2RHSA-2025:10160

Fixed in:0:128.12.0-1.el9_6RHSA-2025:10196

thunderbirdUbuntu

Fixed in:1:128.12.0+build1-0ubuntu0.22.04.1USN-7663-1

Mozilla Thunderbird (en-US)Windows application

Affected:135.0 139.0.2Fixed in:139.0.2Mozilla

Affected:128.11.1Fixed in:128.11.1Mozilla

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionRequired

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploit Intelligence

0.47%probability of exploitation in 30 days

37thpercentile

Low risk: more likely to be exploited than 37% of all known CVEs.

References

Vendor Advisory2

Other references2

Embed a live status badge for CVE-2025-5986

Markdown

[![CVE-2025-5986](https://tridentstack.com/cve/badge/CVE-2025-5986.svg)](https://tridentstack.com/cve/CVE-2025-5986)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-5986"><img src="https://tridentstack.com/cve/badge/CVE-2025-5986.svg" alt="CVE-2025-5986"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-04-13.