This advisory covers several security vulnerabilities in Mozilla Thunderbird, primarily stemming from Firefox components used within Thunderbird. The issues include memory safety bugs (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write in privileged processes triggered by WebGL textures (CVE-2025-11709), cross-process information leaks due to malicious IPC messages (CVE-2025-11710), use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior on web resources without a content-type (CVE-2025-11712), and modification of some non-writable object properties (CVE-2025-11711). These vulnerabilities have been fixed in Thunderbird ESR 140.4 and Thunderbird 144. Red Hat has issued updated packages for Red Hat Enterprise Linux 8.8 variants to address these issues.

The vulnerabilities could allow attackers to exploit memory safety bugs, cause out-of-bounds memory access, leak sensitive information across processes, trigger use-after-free conditions, and override expected browser behaviors. Such issues may lead to potential arbitrary code execution, information disclosure, or privilege escalation within the Thunderbird mail client environment. The advisory rates the security impact as Important (high severity). No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 variants that address these vulnerabilities. Users should apply the security update as provided by Red Hat to remediate these issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. Since official fixes are available, applying the update is the recommended mitigation.