The vulnerability CVE-2025-26695 in Mozilla Thunderbird occurs when requesting an OpenPGP key from a Web Key Directory (WKD) server. Due to incorrect padding size usage in the request, a network observer could infer the length of the requested email address, potentially leaking metadata about the user's communications. This issue was resolved in Thunderbird 136 and Thunderbird ESR 128.8. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium impact with local attack vector, low complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. The vendor advisories from Mozilla explicitly state the fix and provide references to the relevant bugs and updates.

The impact of this vulnerability is limited to information disclosure, specifically the length of the requested email address during OpenPGP key retrieval from WKD servers. There is no indication that the vulnerability allows direct code execution or broader compromise. The CVSS score of 5.3 reflects a medium severity with low confidentiality, integrity, and availability impacts. The vulnerability does not appear to be exploitable remotely without local access or user interaction and does not have known exploits in the wild.

This vulnerability has been fixed in Mozilla Thunderbird versions 136 and 128.8 (ESR). Users and administrators should upgrade to these versions or later to remediate the issue. The vendor advisories from Mozilla confirm that the flaw is addressed in these releases. No additional mitigation steps are required beyond applying the official updates.