This advisory covers several security vulnerabilities in Mozilla Thunderbird as packaged by Red Hat for RHEL 8.6. The issues include memory safety bugs (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write in privileged processes triggered by WebGL textures (CVE-2025-11709), cross-process information leaks due to malicious IPC messages (CVE-2025-11710), a use-after-free vulnerability in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior without a content-type (CVE-2025-11712), and modification of some non-writable Object properties (CVE-2025-11711). These vulnerabilities have been fixed in Thunderbird ESR 140.4 and Thunderbird 144. Red Hat has released updated packages for RHEL 8.6 variants to address these issues.

The vulnerabilities collectively pose a high security impact, including potential memory corruption, information leakage, and unauthorized modification of object properties. Exploitation could lead to privilege escalation or compromise of the Thunderbird mail client environment. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 8.6 variants, including Extended Update Support, Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. Users should apply the Thunderbird update to ESR 140.4 or later as provided by Red Hat to remediate these vulnerabilities. Refer to Red Hat advisory RHSA-2025:19941 and https://access.redhat.com/articles/11258 for detailed update instructions.