This advisory covers nine security fixes in Mozilla Thunderbird related to Firefox components, including a large branch table issue causing truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8035, CVE-2025-8034), incorrect URL stripping in CSP reports (CVE-2025-8031), partial return value writing in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), CSP bypass via XSLT documents (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). Red Hat has issued an update for Thunderbird on Red Hat Enterprise Linux 8 to address these vulnerabilities.

The vulnerabilities collectively impact the security of Mozilla Thunderbird by potentially allowing memory corruption, incorrect enforcement of security policies (CSP), partial execution of JavaScript code, and user-assisted code execution. These issues could lead to unauthorized code execution or bypass of security controls within the Thunderbird client. The advisory rates the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released an updated Thunderbird package for Red Hat Enterprise Linux 8 that addresses all listed vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2025:13676 to remediate these issues. For update instructions, refer to https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.