Mozilla Thunderbird up to 140 IP Address Change dns rebinding

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Mozilla Thunderbird up to 140. The affected element is an unknown function of the component IP Address Change Handler. Performing a manipulation results in dns rebinding. This vulnerability is reported as CVE-2025-8036. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Mozilla Thunderbird up to 140. This affects an unknown functionality of the component IP Address Change Handler. The manipulation with an unknown input leads to a dns rebinding vulnerability. CWE is classifying the issue as CWE-350. The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname. This is going to have an impact on integrity. The summary by CVE is:

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability affects Firefox < 141, Firefox ESR < 140.1, Thunderbird < 141, and Thunderbird < 140.1.

It is possible to read the advisory at bugzilla.mozilla.org. This vulnerability is uniquely identified as CVE-2025-8036 since 07/22/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 11/03/2025). The attack technique deployed by this issue is T1583.002 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 242579 (Mozilla Thunderbird < 141.0), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 141 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242579), EUVD (EUVD-2025-22369) and CERT Bund (WID-SEC-2025-1623). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• IGEL OS
• Mozilla Firefox
• Mozilla Firefox ESR
• Mozilla Thunderbird

Productinfo

Type

• Mail Client Software

Vendor

• Mozilla

Name

• Thunderbird

Version

• 140

License

• open-source

Website

• Vendor: https://www.mozilla.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion