Red Hat issued a security advisory (RHSA-2026:1414) for Mozilla Thunderbird addressing 13 vulnerabilities including CVE-2025-14327 and CVE-2026-0877 through CVE-2026-0891. These include spoofing issues, use-after-free bugs in JavaScript and IPC components, memory safety fixes, sandbox escape vulnerabilities due to incorrect boundary conditions and integer overflow in graphics components, information disclosure in networking and PDF viewer components, mitigation bypass in DOM security, and clickjacking issues. The fixes are included in Thunderbird ESR 140.7 and Thunderbird 147 packages for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. The advisory references detailed CVE pages for individual impact and scoring.

The vulnerabilities collectively could allow attackers to perform spoofing, execute arbitrary code via use-after-free bugs, escape sandbox restrictions, disclose sensitive information, bypass security mitigations, and conduct clickjacking attacks. These issues affect core components of Thunderbird and Firefox ESR versions distributed by Red Hat, potentially compromising confidentiality, integrity, and security of the mail client environment. The Red Hat advisory rates the security impact as Important.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el9_4 and related) for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to Red Hat's article at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided patches.