This Red Hat security advisory (RHSA-2026:1320) addresses a set of 13 vulnerabilities affecting Mozilla Thunderbird versions ESR 140.7 and 147 as distributed in Red Hat Enterprise Linux 9.6 Extended Update Support. The vulnerabilities include spoofing in the Downloads Panel (CVE-2025-14327), multiple use-after-free bugs in JavaScript garbage collection, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and spoofing and clickjacking issues in DOM copy & paste, drag & drop components (CVE-2026-0890). These vulnerabilities were fixed upstream in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147, and Thunderbird 147. The Red Hat advisory provides updated packages to remediate these issues.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption (use-after-free), sandbox escapes, information disclosure, mitigation bypass, and clickjacking. These could allow attackers to bypass security mechanisms, execute arbitrary code, or leak sensitive information within affected Thunderbird clients. The advisory rates the impact as important, indicating significant security concerns but does not specify confirmed exploitation in the wild.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.6 Extended Update Support that address these vulnerabilities. Users should apply the provided security update (thunderbird-140.7.0-2.el9_6) promptly to remediate these issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps beyond applying the official update are indicated in the advisory.