CVE-2025-26696

7.0 highEPSS 0.4%

High (7.0) in mozilla thunderbird. EPSS 0.4% chance of exploitation in the next 30 days.

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

Severity

CVSS 3.1

7.0 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-290
Published: 2025-03-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mozilla:thunderbird

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1864205
https://www.mozilla.org/security/advisories/mfsa2025-17/
https://www.mozilla.org/security/advisories/mfsa2025-18/

Check your stack JSON