CVE-2025-26696

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26696
Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1864205 Issue Tracking
https://www.mozilla.org/security/advisories/mfsa2025-17/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-18/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
History

13 Apr 2026, 15:16

Type Values Removed Values Added
Summary (en) Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability affects Thunderbird < 136 and Thunderbird < 128.8. (en) Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

03 Apr 2025, 13:30

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
First Time Mozilla thunderbird
Mozilla
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1864205 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1864205 - Issue Tracking
References () https://www.mozilla.org/security/advisories/mfsa2025-17/ - () https://www.mozilla.org/security/advisories/mfsa2025-17/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-18/ - () https://www.mozilla.org/security/advisories/mfsa2025-18/ - Vendor Advisory

11 Mar 2025, 20:15

Type Values Removed Values Added
Summary
  • (es) Algunos mensajes de correo electrónico con MIME manipulados a medida que afirmaban contener un mensaje OpenPGP cifrado, cuando en realidad contenían un mensaje firmado con OpenPGP, se mostraban erróneamente como cifrados. Esta vulnerabilidad afecta a Thunderbird &lt; 136 y Thunderbird &lt; 128.8.
CWE CWE-290
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.0

10 Mar 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-10 19:15

Updated : 2026-04-13 15:16

NVD link : CVE-2025-26696

Mitre link : CVE-2025-26696

CVE.ORG link : CVE-2025-26696

JSON object : View

Products Affected

mozilla

  • thunderbird
CWE
CWE-290

Authentication Bypass by Spoofing