The vulnerability enables the Thunderbird for Android application to log library file locations, which may contain sensitive information, to Logcat. This results in the accidental disclosure of system paths that could aid an attacker in discovering the app's internal structure or sensitive configuration data. The weakness is identified as CWE-532, indicating that confidential information found in logs is exposed through the application.

Affected products are Mozilla Thunderbird for Android, with the issue also reported for Firefox. The fix was released in Firefox 138 and Thunderbird 138, meaning any version prior to those may be vulnerable and users of older builds on Android devices are at risk.

The CVSS score is 5.3, placing the vulnerability in the medium severity range. The EPSS score indicates the probability of exploitation is less than 1%, and the vulnerability is not listed in the CISA KEV catalog. Given that Logcat visibility is typically local to the device and can be accessed by any app with the READ_LOGS permission, the likely attack vector is local and requires an attacker who can read the device logs, such as a malicious app or user with device access.