Thunderbird uses the X-Mozilla-External-Attachment-URL header to obtain attachments that can be hosted elsewhere. When a message is opened, the client connects to the URL to determine file size and later downloads the attachment when the user clicks it. Because the URL is not validated or sanitized, an attacker can supply a reference to internal resources such as chrome:// or SMB share file:// links. In Windows environments, this leads to the leakage of hashed credentials, which could enable further attacks. The weakness falls under CWE-1220 (Data Leakage) and CWE-601 (Open Redirect).

Mozilla Thunderbird email client versions prior to 137.0.2 and 128.9.2. Any installation of those earlier releases that processes the X-Mozilla-External-Attachment-URL header is potentially vulnerable. The issue is not specific to a particular operating system but the credential leakage impact applies to Windows-based Thunderbird clients.

The CVSS score of 6.3 indicates a medium severity vulnerability, while the EPSS score of <1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit this flaw by sending a crafted email containing the vulnerable header; the victim must open the message for the client to access the URL and leak credentials. Because the flaw requires user interaction and is limited to the Thunderbird client, the overall risk is moderate, but it can be stepping stone to more serious exploits if the attacker gains additional footholds.