CVE-2025-2817

Description

Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

Reserved 2025-03-26 | Published 2025-04-29 | Updated 2025-05-01 | Assigner mozilla

Problem types

Privilege escalation in Thunderbird Updater

Product status

Any version before 138
affected

Any version before 128.10
affected

Any version before 115.23
affected

Any version before 138
affected

Any version before 128.10
affected

Credits

Dong-uk Kim (@justlikebono)

References

bugzilla.mozilla.org/show_bug.cgi?id=1917536

www.mozilla.org/security/advisories/mfsa2025-28/

www.mozilla.org/security/advisories/mfsa2025-29/

www.mozilla.org/security/advisories/mfsa2025-30/

www.mozilla.org/security/advisories/mfsa2025-31/

www.mozilla.org/security/advisories/mfsa2025-32/

cve.org (CVE-2025-2817)

nvd.nist.gov (CVE-2025-2817)

Download JSON