This advisory covers five distinct security vulnerabilities in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 10. The vulnerabilities include CVE-2025-9182 (denial-of-service via out-of-memory in Graphics WebRender), CVE-2025-9179 (sandbox escape due to invalid pointer in Audio/Video GMP), CVE-2025-9180 (same-origin policy bypass in Graphics Canvas2D), CVE-2025-9181 (uninitialized memory in JavaScript Engine), and CVE-2025-9185 (memory safety bugs fixed in Thunderbird ESR 128.14 and related Firefox ESR versions). Red Hat has released updated Thunderbird packages (version 128.14.0-3.el10_0 and later) that address these issues. The advisory applies to multiple architectures and extended update support versions of Red Hat Enterprise Linux 10.

Successful exploitation of these vulnerabilities could lead to denial-of-service conditions, sandbox escapes, bypass of same-origin policy protections, exposure of uninitialized memory, and other memory safety issues. These impacts could compromise the security boundaries within Thunderbird, potentially allowing attackers to execute unauthorized code or access sensitive information. The severity is rated as high by the source, reflecting the potential for significant security impact if exploited.

Red Hat has released updated Thunderbird packages that fix these vulnerabilities. Users of Red Hat Enterprise Linux 10 and its extended update support versions should apply the Thunderbird update to version 128.14.0-3.el10_0 or later as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.