This advisory covers several security flaws in Mozilla Thunderbird, including CVE-2025-11708 (use-after-free in MediaTrackGraphImpl::GetInstance()), CVE-2025-11709 (out-of-bounds read/write triggered by WebGL textures in a privileged process), CVE-2025-11710 (cross-process information leak via malicious IPC messages), CVE-2025-11711 (modification of some non-writable object properties), CVE-2025-11712 (an OBJECT tag type attribute overriding browser behavior on web resources without a content-type), CVE-2025-11714 and CVE-2025-11715 (memory safety bugs). These vulnerabilities affect Thunderbird as packaged for Red Hat Enterprise Linux 9.4 Extended Update Support and are fixed in Thunderbird ESR 140.4 and Thunderbird 144. The update addresses multiple memory safety and privilege escalation issues derived from Firefox components integrated into Thunderbird.

The vulnerabilities could lead to memory corruption, information disclosure, and potential privilege escalation within the Thunderbird mail client. The issues include use-after-free, out-of-bounds memory access, and cross-process information leaks, which may allow an attacker to execute arbitrary code or access sensitive information. Red Hat rates the security impact as Important, indicating a high severity but not critical. No known exploits in the wild have been reported at this time.

A security update for Thunderbird is available for Red Hat Enterprise Linux 9.4 Extended Update Support, which includes fixes for all listed vulnerabilities. Users should apply the Thunderbird update to version 140.4 or later as provided by Red Hat. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.