This Red Hat security advisory addresses seven distinct vulnerabilities in Mozilla Thunderbird, including sandbox escapes due to use-after-free and undefined behavior in the Graphics Canvas2D component (CVE-2025-10527, CVE-2025-10528), incorrect boundary conditions in the JavaScript garbage collector (CVE-2025-10532), same-origin policy bypass in the Layout component (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure in the Networking Cache component (CVE-2025-10536), and an integer overflow in the SVG component (CVE-2025-10533). These vulnerabilities affect Thunderbird versions prior to 140.3 and 143, as distributed in Red Hat Enterprise Linux 8. The advisory references fixes included in Thunderbird ESR 140.3 and 143 releases. The update is classified as important by Red Hat and addresses multiple critical security issues.

The vulnerabilities collectively could allow attackers to escape sandbox restrictions, bypass same-origin policies, cause memory corruption, disclose sensitive information, or trigger integer overflows within the Thunderbird client. These issues could potentially compromise the security boundaries intended to protect user data and application integrity. Red Hat rates the overall impact as important (high severity). There are no known exploits in the wild at the time of this advisory.

A security update for Thunderbird is available for Red Hat Enterprise Linux 8, including Thunderbird ESR 140.3 and 143 versions. Users should apply the update provided by Red Hat to remediate these vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since the vendor provides an official fix, applying this update is the recommended mitigation. No additional vendor advisories indicate that no action is required.