Red Hat Product Security released an advisory (RHSA-2025:8631) for Mozilla Thunderbird addressing nine CVEs related to memory safety and security issues. The vulnerabilities include out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability that could leak saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), multiple memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and improper isolation of error handling for script execution from web content (CVE-2025-5263). The advisory applies to Red Hat Enterprise Linux Server AUS 8.2 x86_64. Detailed CVSS scores and impact specifics are available on the CVE pages referenced by Red Hat. The update is rated as important by Red Hat Product Security.

The vulnerabilities collectively could lead to memory corruption, information leakage (including sensitive payment card details), and potential local code execution within the Thunderbird client. These issues undermine the security boundaries between web content and script execution, potentially exposing user data and enabling unauthorized actions. The severity is assessed as high by the source, indicating significant risk if exploited.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.2 AUS that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2025:8631 and the referenced article https://access.redhat.com/articles/11258. Since this is a traditional software package, remediation requires applying the vendor-provided update. No indication is given that no action is required or that issues are already mitigated without patching.