medium6.5
CVE-2025-4086
A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog.
Impact
A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mozilla | Firefox | before 138.0 |
| Mozilla | Thunderbird | before 138.0 |