# Multiple Thunderbird vulnerabilities enable arbitrary code execution

Published: 2026-06-09 · Severity: routine · Sectors: government-national, financial-services
Canonical: https://vorant.io/reports/400eba38-74b0-5c9e-86eb-1056fac42e98/multiple-thunderbird-vulnerabilities-enable-arbitrary-code-execution

> Mozilla Thunderbird versions before 140 contain multiple vulnerabilities including use-after-free flaws allowing arbitrary code execution; no active exploitation reported.

Mozilla has released security updates addressing multiple vulnerabilities in Thunderbird, the most severe of which could allow arbitrary code execution through a use-after-free condition in FontFaceSet (CVE-2025-6424) and memory safety bugs (CVE-2025-6436). Successful exploitation could grant an attacker the ability to install programs, modify or delete data, or create new accounts with full user rights, with impact severity depending on the compromised user's privilege level. Additional lower-severity issues include credential exposure (CVE-2025-6425), improper file handling on macOS (CVE-2025-6426), CSP bypass (CVE-2025-6427), URL parsing flaws (CVE-2025-6429), header handling issues (CVE-2025-6430), DNS proxy leaks (CVE-2025-6432), WebAuthn certificate validation bypass (CVE-2025-6433), clickjacking defenses (CVE-2025-6434), and file extension sanitization gaps in developer tools (CVE-2025-6435).

The advisory reports no evidence of active exploitation in the wild at time of publication. Mitigation requires immediate patching to Thunderbird version 140 or later, combined with deployment of least-privilege account policies, exploit protection mechanisms, and endpoint detection controls. Organizations should prioritize patching given the severity of the arbitrary code execution path and the ubiquity of Thunderbird in enterprise and government email environments.

## Mentioned in this report

- Vulnerabilities: CVE-2025-6424, CVE-2025-6425, CVE-2025-6426, CVE-2025-6427, CVE-2025-6429, CVE-2025-6430, CVE-2025-6432, CVE-2025-6433, CVE-2025-6434, CVE-2025-6435, CVE-2025-6436

## Detection guidance (public sample)

### Thunderbird Spawning Shell, Script Interpreter or LOLBin

ATT&CK: T1189

Detects Thunderbird launching command shells, script hosts or common living-off-the-land binaries, a post-exploitation pattern for browser-engine memory corruption bugs such as the FontFaceSet use-after-free (CVE-2025-6424). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Thunderbird Spawning Shell, Script Interpreter or LOLBin
id: 75a35527-d4f2-555c-bd7b-51e4942935bc
status: experimental
description: Detects Thunderbird launching command shells, script hosts or common
  LOLBins. Thunderbird does not normally spawn these, so a child like this suggests
  code execution through a renderer or memory-safety exploit (e.g. CVE-2025-6424,
  CVE-2025-6436). Matches the parent/child relationship, not a specific payload.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-thunderbird-could-allow-for-arbitrary-code-execution_2025-064
tags:
- attack.initial-access
- attack.t1189
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \thunderbird.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
    - \wmic.exe
    - \schtasks.exe
  condition: selection
falsepositives:
- Thunderbird add-ons or user-configured external handlers that deliberately launch
  scripts or cmd.exe
- Users opening a script or installer attachment directly from Thunderbird
level: high
author: Vorant
```

### Thunderbird Child Process Executed From User-Writable Path

ATT&CK: T1189

Detects Thunderbird spawning an executable from temp, public or downloads paths, which can indicate an exploit dropping and running a second-stage payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Thunderbird Child Process Executed From User-Writable Path
id: 2798864e-ea95-5e0f-97dd-5f99085a2e04
status: experimental
description: Detects a Thunderbird child process whose image lives in a user-writable
  staging location (Temp, Downloads, Public, ProgramData). This can follow successful
  exploitation that drops and runs a payload. Opening attachments can trigger it legitimately,
  so treat it as context-dependent.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-thunderbird-could-allow-for-arbitrary-code-execution_2025-064
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \thunderbird.exe
    Image|contains:
    - \AppData\Local\Temp\
    - \Downloads\
    - \Users\Public\
    - \ProgramData\
  filter_installers:
    Image|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
  condition: selection and not filter_installers
falsepositives:
- Users double-clicking a downloaded attachment or installer from within Thunderbird
- Document viewers launched from the Temp attachment cache
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-mozilla-thunderbird-could-allow-for-arbitrary-code-execution_2025-064

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/400eba38-74b0-5c9e-86eb-1056fac42e98/multiple-thunderbird-vulnerabilities-enable-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup