This advisory covers a set of 13 security vulnerabilities impacting Mozilla Thunderbird as packaged in Red Hat Enterprise Linux 10 and its Extended Update Support variants. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM Security (CVE-2026-0877), and clickjacking issues. These issues are fixed in Thunderbird ESR 140.7 and Thunderbird 147. The Red Hat advisory RHSA-2026:2286 provides the official update packages and remediation instructions.

The vulnerabilities collectively could allow attackers to perform spoofing, cause use-after-free conditions leading to potential crashes or code execution, escape sandbox restrictions, disclose sensitive information, bypass security mitigations, and perform clickjacking attacks. These impacts could compromise the security and integrity of the Thunderbird mail client and potentially the underlying system if exploited. However, no known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 10 and its Extended Update Support versions that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:2286 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigations are specified beyond applying the official patches.