The Red Hat security advisory RHSA-2026:0004 addresses multiple vulnerabilities in Mozilla Thunderbird, including use-after-free in the WebRTC signaling component (CVE-2025-14321), memory safety bugs (CVE-2025-14333), JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330), sandbox escape via incorrect boundary conditions in the CanvasWebGL graphics component (CVE-2025-14322), privilege escalation in the Netmonitor and DOM Notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), and same-origin policy bypass in request handling (CVE-2025-14331). These vulnerabilities are fixed in Thunderbird ESR 140.6 and Thunderbird 146. The advisory applies to Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. No CVSS scores are provided in the advisory, but the overall severity is rated as important by Red Hat.

Successful exploitation of these vulnerabilities could lead to memory corruption, use-after-free conditions, sandbox escapes, privilege escalation, and bypass of same-origin policy protections within Thunderbird. This may allow attackers to execute arbitrary code, escalate privileges, or bypass security restrictions in the affected mail client. The advisory does not report known exploits in the wild at this time.

Red Hat has released updated Thunderbird packages (version 140.6.0-1.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support and related variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.