A specially crafted filename containing numerous encoded newline characters can hide the true file extension from the download dialog, making it appear as a safe type. The malicious file may deceive users into trusting or executing it, thus compromising system integrity and potentially leading to malware execution.

Mozilla Thunderbird for Android is affected; other Thunderbird versions are unaffected. Firefox is not impacted. The issue was fixed in Thunderbird version 138, so any installation prior to that applies.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of under 1% shows a low probability of exploitation. Exploitation requires user interaction: a malicious actor must provide a file with an encoded-newline payload that the user downloads, and the file must be opened or executed on the device. The attack vector is inferred to be social engineering through downloads from potentially untrusted sources.