CVE-2025-26696

Description

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability affects Thunderbird < 136 and Thunderbird < 128.8.

References

https://www.mozilla.org/security/advisories/mfsa2025-18/

https://www.mozilla.org/security/advisories/mfsa2025-17/

https://bugzilla.mozilla.org/show_bug.cgi?id=1864205

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3