This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird, including memory safety bugs (CVE-2025-14333), use-after-free in the WebRTC signaling component (CVE-2025-14321), JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape due to incorrect boundary conditions in the Graphics CanvasWebGL component (CVE-2025-14322), privilege escalation in the Netmonitor and DOM Notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), and same-origin policy bypass in the Request Handling component (CVE-2025-14331). These vulnerabilities affect Thunderbird ESR 140.6 and Thunderbird 146 versions. The advisory provides updated packages for Red Hat Enterprise Linux 8.6 and related services. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat, and the overall threat is assessed as high severity.

The vulnerabilities collectively could allow attackers to exploit memory safety issues, execute use-after-free attacks, cause JIT miscompilation leading to potential code execution or logic errors, escape sandbox restrictions, escalate privileges within the application, and bypass same-origin policy protections. These impacts can compromise the confidentiality, integrity, and security boundaries of the Thunderbird mail client. The advisory does not report known exploits in the wild at the time of publication.

Red Hat has released updated Thunderbird packages (version 140.6.0-1.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official security updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.