CVE-2025-4090

MediumCVSS 5.3

Published: 29/04/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

23th percentile - higher than 23% of all known CVEs

Summary

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Risk Assessment

Sensitive library location information may be exposed in device logs, potentially aiding an attacker in further exploitation. The risk affects devices running a vulnerable version of Thunderbird for Android.

Recommendation

Update Thunderbird for Android to version 138 or later. Restrict access to Logcat logs on mobile devices within the organization.

Other vulnerabilities in Thunderbird for Android

CVE-2025-4086Medium
A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Original NVD description (English source)

A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS