Mozilla Thunderbird versions prior to 128.10.1 and 138.0.1 parse the From header in a way that can allow sender spoofing if the mail server accepts invalid From addresses. For example, if the From header contains an invalid value such as "Spoofed Name spoofed@example.com legitimate@example.com", Thunderbird treats spoofed@example.com as the actual sender address. This parsing flaw can be exploited to impersonate senders. The issue is tracked as CVE-2025-3875 and was fixed in Thunderbird 128.10.1 and 138.0.1 as per Mozilla security advisories MFSA 2025-34 and MFSA 2025-35.

The vulnerability allows an attacker to spoof the sender address in emails viewed in Thunderbird, potentially misleading recipients about the origin of messages. This can facilitate phishing or social engineering attacks. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact. There is no indication of known exploits in the wild at this time.

Mozilla has released official fixes for this vulnerability in Thunderbird versions 128.10.1 and 138.0.1. Users and administrators should update to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.