This advisory covers a set of nine security vulnerabilities in Mozilla Thunderbird, primarily related to Firefox components embedded within Thunderbird. The vulnerabilities include a race condition in the graphics component (CVE-2025-13012), mitigation bypasses in DOM security and core HTML components (CVE-2025-13018, CVE-2025-13013), use-after-free bugs in audio/video and WebRTC components (CVE-2025-13014, CVE-2025-13020), same-origin policy bypasses in DOM workers and notifications components (CVE-2025-13019, CVE-2025-13017), a spoofing issue (CVE-2025-13015), and incorrect boundary conditions in the JavaScript WebAssembly component (CVE-2025-13016). These vulnerabilities collectively impact the security posture of Thunderbird on Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat has released updated Thunderbird packages addressing these issues.

The vulnerabilities collectively could allow attackers to bypass security mitigations, execute use-after-free exploits potentially leading to arbitrary code execution or crashes, bypass same-origin policy restrictions, cause race conditions affecting graphics rendering, and perform spoofing attacks. These issues impact the confidentiality, integrity, and security boundaries within Thunderbird's mail and newsgroup client functionality. The severity is rated as Important by Red Hat, indicating a high security impact but no confirmed exploits in the wild at the time of advisory publication.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:21844 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.