This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird, including CVE-2025-14327 and twelve additional CVEs from 2026, affecting components like Downloads Panel, JavaScript GC, Graphics (CanvasWebGL), IPC, JavaScript Engine, Networking, DOM security, Copy & Paste, Drag & Drop, and PDF Viewer. The issues include spoofing, use-after-free, memory safety bugs, sandbox escapes due to boundary condition errors and integer overflow, information disclosure, mitigation bypass, and clickjacking. These vulnerabilities were fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. The advisory specifically targets Red Hat Enterprise Linux 8.6 variants and provides updated Thunderbird packages to address these security flaws.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption (use-after-free), sandbox escapes that could allow code execution outside restricted environments, information disclosure, mitigation bypasses, and clickjacking. These issues could potentially allow attackers to compromise the confidentiality, integrity, or security boundaries of the Thunderbird mail client on affected Red Hat Enterprise Linux 8.6 systems.

An official security update for Thunderbird is available for Red Hat Enterprise Linux 8.6 variants (AUS, E4S, TUS, and SAP Solutions). Users should apply the Thunderbird update version 140.7.0-1.el8_6 or later as provided by Red Hat to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:1487 and the update instructions at https://access.redhat.com/articles/11258 for detailed patching guidance.