id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
21457	thunderbird-128.9.2esr	Joe Locash	Douglas R. Reno	"**What’s Fixed
**
 - Two-factor auth via text or email did not work with Office 365 using Oauth2.
 - IRC channel was not visible after restart.
 - Global indexing failed when processing email with invalid calendar data

**Security fixes**
  https://www.mozilla.org/en-US/security/advisories/mfsa2025-27/
 - CVE-2025-3522: Leak of hashed Window credentials via crafted attachment URL (high)
 - CVE-2025-2830: Information Disclosure of /tmp directory listing (high)
 - CVE-2025-3523: User Interface (UI) Misrepresentation of attachment URL (low)
"	enhancement	closed	elevated	12.4	BOOK	git	medium	fixed