This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 8.6 variants. The issues include spoofing in the Downloads Panel (CVE-2025-14327), use-after-free bugs in JavaScript GC and IPC components (CVE-2026-0885, CVE-2026-0882), memory safety bugs fixed in Thunderbird ESR 140.7 and Thunderbird 147 (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), spoofing in DOM copy & paste and drag & drop (CVE-2026-0890), and use-after-free in the JavaScript engine (CVE-2026-0884). These vulnerabilities are collectively addressed by updated Thunderbird packages released by Red Hat for their Enterprise Linux 8.6 distributions.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption leading to potential crashes or code execution, sandbox escapes allowing code to break out of restricted environments, information disclosure of potentially sensitive data, mitigation bypasses weakening security controls, and clickjacking attacks. These issues could allow attackers to manipulate Thunderbird behavior, access unauthorized information, or execute arbitrary code under certain conditions. The overall security impact is rated as Important by Red Hat, indicating significant risk if unpatched.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:1487 to remediate the issues. Details on applying the update are available at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.