The vulnerability CVE-2025-26696 in Mozilla Thunderbird involves the incorrect display of certain crafted MIME email messages. Specifically, messages that claimed to contain encrypted OpenPGP content but actually contained signed OpenPGP content were shown as encrypted, potentially misleading users about message confidentiality. This flaw was addressed and fixed in Thunderbird 136 and Thunderbird ESR 128.8. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects a network attack vector with high confidentiality impact, low integrity and availability impacts, and requires high attack complexity without privileges or user interaction. Mozilla's official advisories (MFSA2025-17 and MFSA2025-18) confirm the fix and provide additional context on related vulnerabilities fixed in these releases.

The primary impact of CVE-2025-26696 is the incorrect indication that an email message is encrypted when it is not, potentially causing users to mistakenly believe their communication is confidential when it is only signed. This could lead to disclosure of sensitive information if users rely on the encryption indicator for security decisions. The CVSS score of 7.0 indicates a high severity impact on confidentiality, with lesser impacts on integrity and availability. There are no known exploits in the wild. The vulnerability does not allow direct code execution or privilege escalation but affects user trust in message security.

This vulnerability has been fixed in Mozilla Thunderbird versions 136 and ESR 128.8. Users and administrators should upgrade to these versions or later to remediate the issue. The vendor advisories explicitly confirm the availability of these fixes. No additional mitigation steps are required beyond applying the official updates. Since scripting is disabled when reading mail, exploitation through email is limited. Verify that Thunderbird installations are updated to at least version 136 or 128.8 ESR to ensure protection.