An email containing multiple attachments can include external URLs via the X-Mozilla-External-Attachment-URL header. Thunderbird displays only the last of those URLs as the hover text for every attachment, while the correct URL is used when the attachment is clicked. This visual inconsistency can mislead users into thinking that a safe link is being displayed, potentially causing them to download content from untrusted or malicious sources. The flaw is classified as CWE‑451 – Untrustworthy Implementation of a Safety‑Relevant Function. The impact is primarily social engineering; a user can be tricked into interacting with a harmful attachment, which may compromise confidentiality, integrity, or availability of the user’s machine or data.

The vulnerability affects the Mozilla Thunderbird email client in all versions prior to Thunderbird 128.9.2 and Thunderbird 137.0.2. No other vendor or product is listed as affected in this report. The specific affected releases are therefore all Thunderbird builds older than the two patched versions, irrespective of platform. No additional products or operating system components are indicated.

The CVSS score of 6.4 reflects moderate severity. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and the issue is not currently listed in CISA’s KEV catalog. Attackers would need to craft an email that targets Thunderbird users and relies on the hover misrepresentation to influence user behavior. Therefore, the risk is primarily driven by user interaction and social engineering rather than automated exploitation.