Thunderbird can incorrectly render a message/rfc822 attachment that claims to be a PDF as HTML. The attachment is auto‑saved to a temporary location and linked through the file:/// protocol. This process allows an embedded JavaScript payload to execute in the context of the mail client without a user‑initiated download. The vulnerability essentially grants an attacker the ability to run code with privileges conferred to the Thunderbird process, compromising confidentiality, integrity, and availability of the affected system. The weakness is mapped to CWE‑290 and CWE‑356, indicating improper authentication and sensitive information exposure through the mishandling of attachment headers.

Mozilla Thunderbird on all platforms is affected when using session sessions older than Thunderbird 128.10.1 for the standard release and older than 138.0.1 for the long‑term release. The attack can be carried out via any email account that receives a crafted nested attachment; the operating system is irrelevant as the exploit depends on Thunderbird’s internal handling of the X‑Mozilla‑External‑Attachment‑URL header.

The CVSS score of 8.1 places the vulnerability in the high severity band. The EPSS score of less than 1% indicates a low but non‑zero probability of exploitation in the wild. At present, the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed public exploits. Based on the description, the likely attack vector is an email containing a specially crafted attachment delivered to a user's mailbox; the employer or attacker must send the email and the user must open it for code execution. The exploit does not require elevated privileges beyond those already granted to the user running Thunderbird. The risk is therefore moderate to high for organizations that process sensitive emails and for users who download attachments from unknown or compromised sources.