This Red Hat security advisory addresses a set of vulnerabilities in Mozilla Thunderbird, including memory safety bugs (CVE-2025-14333), use-after-free in WebRTC signaling (CVE-2025-14321), multiple JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to incorrect boundary conditions in the CanvasWebGL graphics component (CVE-2025-14322), privilege escalation in the Netmonitor component (CVE-2025-14328, CVE-2025-14329) and DOM notifications component (CVE-2025-14323), and a same-origin policy bypass in the request handling component (CVE-2025-14331). These vulnerabilities affect Thunderbird ESR 140.6 and Thunderbird 146 versions. The advisory provides updated packages for Red Hat Enterprise Linux 10.0 Extended Update Support across multiple hardware architectures. The update fixes these issues by incorporating patches from Firefox ESR 140.6 and Firefox 146 releases.

The vulnerabilities collectively could allow an attacker to execute arbitrary code, escalate privileges, bypass security policies such as same-origin, or escape sandbox restrictions within the Thunderbird mail client. This could lead to unauthorized access or control over the affected system. The Red Hat advisory rates the security impact as Important (high severity). There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Thunderbird packages (version 140.6.0-1.el10_0) for Red Hat Enterprise Linux 10.0 Extended Update Support on multiple architectures. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described security issues.