This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird and related Firefox components. The issues include CVE-2025-9182 (denial-of-service via out-of-memory in Graphics: WebRender), CVE-2025-9179 (sandbox escape due to invalid pointer in Audio/Video: GMP), CVE-2025-9180 (same-origin policy bypass in Graphics: Canvas2D), CVE-2025-9181 (uninitialized memory in JavaScript Engine), and CVE-2025-9185 (memory safety bugs fixed in multiple ESR and standard releases of Firefox and Thunderbird). The vulnerabilities affect Thunderbird as packaged in Red Hat Enterprise Linux 8.2 Advanced Update Support. Red Hat has released updated Thunderbird packages (version 128.14.0-3.el8_2) that include fixes for these issues. The advisory references fixes in Firefox ESR 115.27, 128.14, 140.2, and Thunderbird ESR 128.14, 140.2, and standard releases 142.

The vulnerabilities collectively could allow denial-of-service conditions, sandbox escapes, bypassing of same-origin policy, exposure of uninitialized memory, and other memory safety issues. These impact the security boundaries of the Thunderbird mail client and could lead to unauthorized code execution or information disclosure if exploited. The advisory rates the overall impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.2 Advanced Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:15437 and the referenced article https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official update.