This Red Hat security advisory addresses five distinct vulnerabilities in Mozilla Thunderbird and related Firefox components. CVE-2025-9182 involves a denial-of-service condition caused by out-of-memory in the Graphics WebRender component. CVE-2025-9179 is a sandbox escape vulnerability due to an invalid pointer in the Audio/Video GMP component. CVE-2025-9180 allows same-origin policy bypass in the Graphics Canvas2D component. CVE-2025-9181 concerns uninitialized memory in the JavaScript Engine component. CVE-2025-9185 covers multiple memory safety bugs fixed in Thunderbird ESR 128.14, 140.2, and Firefox ESR versions 115.27, 128.14, 140.2, and Firefox 142. Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.8 variants to remediate these issues. The advisory does not provide CVSS scores but classifies the update as Important with a high severity rating.

The vulnerabilities collectively impact the security posture of Mozilla Thunderbird by enabling denial-of-service, sandbox escape, same-origin policy bypass, and memory safety issues. These could potentially allow attackers to disrupt service, escape sandbox restrictions, bypass security policies, or cause memory corruption. The advisory does not report known exploits in the wild. The impact is rated as Important by Red Hat and severity as high.

Red Hat has released security updates for Thunderbird in Red Hat Enterprise Linux 8.8 and related update services. Users should apply these official patches to remediate the vulnerabilities. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated beyond applying the provided updates.