This Red Hat security advisory (RHSA-2026:1462) addresses multiple vulnerabilities in Mozilla Thunderbird as distributed in Red Hat Enterprise Linux 8.8. The vulnerabilities include CVE-2025-14327 (spoofing in Downloads Panel), CVE-2026-0885 (use-after-free in JavaScript GC), CVE-2026-0891 (memory safety bugs), CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886 (sandbox escapes and boundary condition issues in Graphics components), CVE-2026-0882 (use-after-free in IPC), CVE-2026-0884 (use-after-free in JavaScript Engine), CVE-2026-0883 (information disclosure in Networking), CVE-2026-0877 (mitigation bypass in DOM security), CVE-2026-0890 (spoofing in DOM copy & paste and drag & drop), and CVE-2026-0887 (clickjacking and information disclosure in PDF Viewer). These vulnerabilities are fixed in Thunderbird ESR 140.7 and Thunderbird 147. The advisory provides updated packages for Red Hat Enterprise Linux 8.8 variants. No known exploits in the wild have been reported at the time of the advisory.

The vulnerabilities collectively could allow attackers to perform spoofing, execute use-after-free attacks leading to potential arbitrary code execution, bypass security mitigations, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts affect the confidentiality, integrity, and security boundaries of the Thunderbird mail client. However, no known exploits in the wild have been reported. The severity is rated as high by Red Hat Product Security.

An official security update is available from Red Hat for Thunderbird in Red Hat Enterprise Linux 8.8 variants. Users should apply the Thunderbird update to version 140.7 or later as provided by Red Hat to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:1462 and the article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated beyond applying the official patch.