Red Hat Product Security issued advisory RHSA-2026:0003 detailing security fixes for Mozilla Thunderbird, addressing ten CVEs (CVE-2025-14321 through CVE-2025-14333). The vulnerabilities include memory safety bugs, use-after-free in WebRTC signaling, JIT miscompilation in the JavaScript engine, sandbox escape via CanvasWebGL, privilege escalations in Netmonitor and DOM notifications, and same-origin policy bypass in request handling. These bugs affect Thunderbird ESR 140.6 and Thunderbird 146, which share codebase components with Firefox ESR 140.6 and Firefox 146. The advisory provides updated Thunderbird packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related product variants. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat and high in the source data. No known exploits in the wild are reported.

Successful exploitation of these vulnerabilities could lead to memory corruption, use-after-free conditions, sandbox escapes, privilege escalation, and bypass of same-origin policy within the Thunderbird mail client. This could allow attackers to execute arbitrary code, escalate privileges, or bypass security restrictions, potentially compromising user data and system integrity. The vulnerabilities affect core components shared with Firefox, increasing the risk surface. However, no known active exploits have been reported at this time.

Red Hat has released updated Thunderbird packages (version 140.6.0-1.el9_6) for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's advisory and update article at https://access.redhat.com/articles/11258. Since the advisory provides an official fix, applying the update is the recommended mitigation. No additional vendor-recommended mitigations are indicated.