This Red Hat security advisory addresses seven distinct vulnerabilities in Mozilla Thunderbird related to graphics rendering, JavaScript garbage collection, layout policy enforcement, networking cache, and SVG processing. The issues include sandbox escapes caused by use-after-free and invalid pointer dereferences in the Canvas2D graphics component (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass in the Layout component (CVE-2025-10529), incorrect boundary conditions in the JavaScript garbage collector (CVE-2025-10532), information disclosure in the networking cache (CVE-2025-10536), integer overflow in the SVG component (CVE-2025-10533), and other memory safety bugs fixed in Thunderbird ESR 140.3 and Thunderbird 143 (CVE-2025-10537). These vulnerabilities could allow sandbox escapes, policy bypasses, information leaks, or memory corruption. Red Hat has issued an important security update for Thunderbird in Red Hat Enterprise Linux 10 to remediate these issues.

The vulnerabilities collectively pose a high security risk, including potential sandbox escapes that could allow attackers to break out of restricted execution environments, bypasses of same-origin policy which could lead to unauthorized access to web content, information disclosure through networking cache flaws, and memory safety issues that could cause crashes or arbitrary code execution. These impacts affect the security and integrity of Thunderbird as a mail and newsgroup client, potentially exposing users to elevated risks if exploited.

A security update for Mozilla Thunderbird is available from Red Hat for Red Hat Enterprise Linux 10. Users should apply the Thunderbird ESR 140.3 update or later versions as provided by Red Hat to remediate these vulnerabilities. Refer to the official Red Hat advisory RHSA-2025:16157 and the update instructions at https://access.redhat.com/articles/11258 for detailed guidance on applying the patch. No additional mitigation steps are required beyond applying the official update.