This advisory covers a broad set of security fixes for Mozilla Thunderbird, addressing numerous vulnerabilities including use-after-free, memory safety bugs, privilege escalation, sandbox escapes, incorrect boundary conditions, integer overflows, race conditions, undefined behavior, information disclosure, denial-of-service, spoofing, and out-of-bounds reads. The affected components include the JavaScript engine, graphics subsystems (Canvas2D, WebRender, Text), audio/video codecs (Web Codecs, GMP, Playback), networking (HTTP), WebRTC signaling, XPCOM, CSS parsing, layout, widget components, telemetry, and IMAP parsing. These vulnerabilities have been fixed in Thunderbird ESR 140.9 and Thunderbird 149, with corresponding fixes in Firefox ESR 115.34, Firefox ESR 140.9, and Firefox 149. Red Hat has issued updates for Thunderbird in Red Hat Enterprise Linux 9.2 to mitigate these issues.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, escape sandbox restrictions, cause denial-of-service conditions, disclose sensitive information, and spoof content within the Thunderbird mail client. The wide range of affected components and types of vulnerabilities indicate multiple potential attack vectors. The severity is rated as high by Red Hat Product Security.

Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply the official Red Hat security update RHSA-2026:8287 promptly to remediate these issues. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the vendor-provided update.