Word Cross-References Appear Duplicated When Opened Directly via Thunderbird

Summary

When a Microsoft Word .docx file received as a Thunderbird email attachment is opened directly (without saving to disk first), cross-references in the document appear duplicated — e.g. "Table 2  Table 2  Table 2". Saving the file to disk and then opening it displays correctly.

Environment

* The issue does not reproduce on all machines (see "Triage" below).

Steps to Reproduce

1. Download the reproduction file thunderbird_bug_minimal2.docx below.
2. Attach it to an email and send it to yourself.
3. In Thunderbird, receive the email and open the attachment directly (do not save first).
4. Observe that the cross-references "Table 2" and "Table 3" appear duplicated in the document body.
5. Now use "Save Attachment" to save the file to disk, then open it — the references display correctly.

Triage Results

Root Cause Analysis

Unpacking the .docx and inspecting word/document.xml revealed that the cross-reference fields (REF fields) are doubly nested:

<!-- Outer field (redundant) -->
<w:fldChar w:fldCharType="begin"/>
<w:instrText> REF _Ref228461093 \* MERGEFORMAT </w:instrText>
<w:fldChar w:fldCharType="separate"/>

  <!-- Inner field (the intended REF) -->
  <w:fldChar w:fldCharType="begin"/>
  <w:instrText> REF _Ref228461093 \* MERGEFORMAT </w:instrText>
  <w:fldChar w:fldCharType="separate"/>
  <w:t>Table 2</w:t>
  <w:fldChar w:fldCharType="end"/>

<w:fldChar w:fldCharType="end"/>

When opened normally, Word resolves only the inner field and displays correctly. When opened via Thunderbird's temporary file path, Word appears to expand both fields, causing the duplication.

Which product is at fault?

Workaround

Reproduction File

The following file has been confirmed to reproduce the issue.

Addendum: Reassignment of Fault

May 2026

Upon further reflection after publication, we have revised our assessment: the root cause of this issue lies squarely with Microsoft Word generating malformed XML.

A doubly-nested REF field is an invalid structure under the OOXML specification. A correctly implemented application should never produce such a file in the first place.

Thunderbird merely received the malformed file and passed it to Word via a temporary path — making it closer to a victim than a culprit. The fact that Word displays the file correctly when opened normally simply means Word is silently papering over its own malformed output, which in turn delayed discovery of the problem.

About This Page