CVE-2025-4086

Specially crafted filename could be used to obscure download type

6.5 Medium

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.29%Up 0.3 points since Apr 30, 2025

What each source reports

CVE List Score used 6.5

Specially crafted filename could be used to obscure download type

Record: CVE-2025-4086
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-451
Updated: 2026-11-02

EUVDEUVD-2025-12656 6.5

Record: EUVD-2025-12656
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-54jr-pmx4-5pvr 6.5

A specially crafted filename containing a large number of encoded newline characters could...

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox < 138 and Thunderbird < 138.

Record: GHSA-54jr-pmx4-5pvr
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-451
Updated: 2026-11-02

NVD 6.5

Record: CVE-2025-4086
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-451
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15045-1 No score

MozillaFirefox-138.0-1.1 on GA media

These are all security issues fixed in the MozillaFirefox-138.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15045-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11373-1 No score

firefox-esr-153.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-153.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11373-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`MozillaFirefox` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 138.0-1.1	138.0-1.1
`firefox-esr` openSUSE:Tumbleweed From an advisory covering 228 CVEs	before 153.0-1.1	153.0-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-4086 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published April 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. No source names a fixed version.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 35 references. The JSON record has them.