This advisory covers a set of 13 security vulnerabilities impacting Mozilla Thunderbird as packaged in Red Hat Enterprise Linux 9.4 Extended Update Support. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript garbage collection, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These issues were fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. The Red Hat advisory RHSA-2026:1414 provides updated packages to remediate these vulnerabilities.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and potentially execute arbitrary code or cause memory corruption in affected Thunderbird versions. The presence of use-after-free and sandbox escape vulnerabilities indicates a risk of code execution or privilege escalation. Information disclosure and clickjacking issues could compromise user data confidentiality and integrity. The overall impact is rated as important by Red Hat.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update RHSA-2026:1414 promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.