This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird, including memory safety bugs (CVE-2025-14333), use-after-free in the WebRTC signaling component (CVE-2025-14321), JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to incorrect boundary conditions in the CanvasWebGL graphics component (CVE-2025-14322), privilege escalation in the Netmonitor component (CVE-2025-14328, CVE-2025-14329) and DOM notifications component (CVE-2025-14323), and a same-origin policy bypass in the request handling component (CVE-2025-14331). These vulnerabilities affect Thunderbird ESR 140.6 and Thunderbird 146 versions. Red Hat has issued updated packages for Red Hat Enterprise Linux 8 and extended life cycle releases to fix these issues. The advisory references multiple bugzilla entries and CVE pages for detailed information. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, bypass security policies such as same-origin, and escape sandbox restrictions within the Thunderbird mail client. This could compromise the confidentiality, integrity, and availability of user data and the affected system. The issues affect critical components like memory management, JavaScript execution, graphics rendering, and network monitoring within Thunderbird. Red Hat rates the overall security impact as Important (high severity).

Red Hat has released updated Thunderbird packages (version 140.6.0-1.el8_10 and corresponding builds) for Red Hat Enterprise Linux 8 and its extended life cycle variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.