This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird and Firefox components integrated within Thunderbird. The issues include a denial-of-service caused by out-of-memory in the Graphics WebRender component (CVE-2025-9182), a sandbox escape due to an invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Graphics Canvas2D component (CVE-2025-9180), uninitialized memory usage in the JavaScript Engine component (CVE-2025-9181), and multiple memory safety bugs fixed in recent ESR and standard releases (CVE-2025-9185). Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8 and its Extended Life Cycle versions on multiple architectures to remediate these vulnerabilities.

The vulnerabilities collectively could allow denial-of-service conditions, sandbox escapes, bypassing of same-origin policy restrictions, and memory safety issues, which may lead to potential security breaches or instability in the Thunderbird mail client. The severity is rated as Important by Red Hat, indicating a high impact on confidentiality, integrity, or availability if exploited.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8 and Extended Life Cycle 8.10 across all supported architectures. Users should apply these official updates promptly to remediate the vulnerabilities. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified.