This vulnerability stems from unsanitized URI fields in the Thunderbird Address Book. A malicious address book can contain links that, when imported and clicked by a user, launch a web page within Thunderbird. The page is able to execute unprivileged JavaScript, potentially allowing an attacker to perform arbitrary script operations in the context of the Thunderbird client. The weakness is related to CWE-79 (Cross‑Site Scripting) and CWE-601 (Open Redirect), and can lead to data theft, phishing, or further exploitation within the user's environment.

All users of Mozilla Thunderbird running versions prior to 128.7 and 135 are affected. The vulnerability is not tied to a specific operating system, but the associated CPEs include various Red Hat Enterprise Linux releases that may host Thunderbird. Any installation that imports address books from untrusted sources can be impacted.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of 24% reflects a relatively high likelihood that attackers will exploit this flaw in the near term. Because the attack requires the victim to import a crafted address book and click the malicious link, it is a user‑interaction vector that is easier to execute with social engineering. The vulnerability is not listed in the CISA KEV catalog, but given its attack surface and exploitation probability, an organization should treat it as a significant risk.