When replying to, forwarding, or editing a crafted email in Thunderbird, the application can embed parts of a different message that resides in the same folder. The embedded content is included in the composed message without displaying a blocked content warning. If the user sends the message, recipients receive the unintended content, effectively disclosing information that was not intended to be shared.

The vulnerability affects Mozilla Thunderbird. All releases prior to Thunderbird 159 and Thunderbird 153.6 are susceptible; the flaw was addressed in those two releases.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The flaw can be exploited by an attacker who successfully delivers a crafted email message to a Thunderbird user, leveraging the application’s message composition logic to expose confidential data. Because the attack requires the user to send or edit a message, the impact is confined to the user’s environment and involves a potential confidentiality breach.