Thunderbird will display an incorrect sender address when the From field uses an invalid group name syntax, allowing an attacker to spoof the return address of an email. The flaw is a result of improper validation of the From header and can be used to trick users into believing a message originates from a legitimate sender, potentially leading to phishing or social engineering attacks. This weakness is reflected in the CWE identifiers CWE-345 and CWE-451.

All Mozilla Thunderbird installations older than version 128.7 are affected, as the fix was applied in releases 128.7 and 135. No explicit operating system restrictions are listed, so the issue is present on all platforms supported by Thunderbird.

The CVSS score of 6.5 indicates a moderate impact. The EPSS score of < 1% shows a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, an attacker would need to send a crafted email containing a malformed From header to a user running an affected Thunderbird version, relying on the user to open or view the message. The lack of a known public exploit and the low exploitation probability suggest that the risk is moderate, but it remains advisable to apply the available patch promptly.