This Red Hat security advisory covers a set of 13 vulnerabilities impacting Mozilla Thunderbird as packaged in Red Hat Enterprise Linux 9.2. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics and CanvasWebGL components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking (CVE-2026-0887). These issues are fixed in Thunderbird ESR 140.7 and Thunderbird 147 as delivered by Red Hat. The advisory is rated as Important by Red Hat Product Security.

The vulnerabilities collectively could allow attackers to perform spoofing, bypass mitigations, cause memory corruption through use-after-free bugs, escape sandbox restrictions, disclose sensitive information, and conduct clickjacking attacks. These impacts may compromise the confidentiality, integrity, and security boundaries of the Thunderbird mail client. However, no known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply the security update as soon as possible following Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the provided patches.