A vulnerability in Thunderbird allows an attacker to craft a MIME email that claims to contain an encrypted OpenPGP message but actually contains a signed message. The application incorrectly displays the message as being encrypted, potentially misleading the user into believing the content is protected by encryption when it is not. This misrepresentation can enable phishing or social engineering attacks by making unencrypted or weakly protected content appear trustworthy. The issue reflects weaknesses in authentication (CWE-290) and security misconfiguration (CWE-451). Based on the description, it is inferred that the deceptive labeling could be leveraged for phishing or social engineering attacks.

Mozilla Thunderbird is the only affected product. All releases prior to Thunderbird 128.8 and 136 have the vulnerability; it was fixed in the 128.8 and 136 releases.

The CVSS score of 7 indicates a moderate severity. The EPSS score of less than 1% shows a very low but existent probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via a crafted email that the user opens in Thunderbird; no additional authentication or local privileges are required. The risk is primarily to the user’s trust in the email’s security status rather than to system compromise.