Thunderbird processes the From header in a way that can allow an attacker to spoof the sender address when the mail server permits an invalid From value. The invalid header, such as 'Spoofed Name ', leads Thunderbird to treat spoofed@example.com as the legitimate address, allowing impersonation of trusted senders. This vulnerability is a form of authentication bypass (CWE‑290) that could mislead users and facilitate phishing or fraud.

Mozilla Thunderbird users running versions prior to 128.10.1 and 138.0.1 are potentially affected. The CVE description confirms the issue was fixed in those releases.

The CVSS score of 7.5 indicates a high severity, but the EPSS score of < 1% suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it simply by sending a crafted email with an improperly formatted From header from a server that accepts such headers, with no additional privileges required. The attack would not directly compromise the system but could deceive users into trusting spoofed messages.