We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an (invalid) value "Spoofed Name ", Thunderbird treats spoofed@example.com as the actual address. This vulnerability affects Thunderbird < 128.10.1 and Thunderbird < 138.0.1.
Reserved 2025-04-22 | Published 2025-05-14 | Updated 2025-05-15 | Assigner mozillaSender Spoofing via Malformed From Header in Thunderbird
xh4vm
bugzilla.mozilla.org/show_bug.cgi?id=1950629
www.mozilla.org/security/advisories/mfsa2025-34/
www.mozilla.org/security/advisories/mfsa2025-35/
Support options
