When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the…
Priority HIGH 66CWE-146Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.
Summary
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00692 53rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | xdg-utils | xdg-utils 1.1.0 to and including 1.1.3 | — | No fix listed | CNA |
- xdg-utils Vendor— Affected xdg-utils 1.1.0 to and including 1.1.3 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:* | 1.1.0 – 1.1.3 | Vulnerable | Freedesktop |
- cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:* Versions 1.1.0 – 1.1.3 Vulnerable ·Freedesktop
Remediation
Red Hat 1 advisory
- RHSA-2025:7672 Released 2025-05-15 · Red Hat rating Moderatexdg-utils security update
- Red Hat Enterprise Linux AppStream (v. 9) xdg-utils-1.1.3-13.el9_6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2025:7672 |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-4055
- 2026-10-03 Alias added: GHSA-p4jr-wm76-h2v3
References
More Freedesktop Xdg-utils vulnerabilities
- TI-2015-01685 The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when… CVSS 3.1HIGH 8.8
- TI-2017-13451 The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings… CVSS 3.0HIGH 8.8
- TI-2009-00064 Interaction error in xdg-open allows remote attackers to execute arbitrary code by… CVSS 2.0MEDIUM 6.8
- TI-2020-16833 A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. CVSS 3.1MEDIUM 6.5
Sources
- CVE-2022-4055 · CVE Program
- CVE-2022-4055 · NVD
- FIRST EPSS
- GHSA-p4jr-wm76-h2v3 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-4055 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences