Red Hat Product Security issued an advisory (RHSA-2025:10160) for Mozilla Thunderbird on Red Hat Enterprise Linux 9.2, addressing several vulnerabilities including CVE-2025-5986. The primary issues fixed are unsolicited file download, disk space exhaustion, and credential leakage via mailbox:/// links. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9.2. Although no CVSS score is provided, the update is rated as Important. The advisory references multiple CVEs and provides updated Thunderbird packages to remediate the vulnerabilities.

The vulnerabilities could allow an attacker to cause unsolicited file downloads, exhaust disk space, and leak credentials through specially crafted mailbox:/// links in Thunderbird. These issues could compromise user data confidentiality and system stability. The impact is significant enough for Red Hat to rate the update as Important, indicating a high security risk if unpatched.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply the official update as described in the Red Hat advisory (RHSA-2025:10160) and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the provided patch.