Red Hat Product Security released an advisory (RHSA-2025:13651) addressing nine distinct security vulnerabilities affecting Mozilla Thunderbird in Red Hat Enterprise Linux 8.6. The issues include a large branch table leading to truncated instructions (CVE-2025-8028), multiple memory safety bugs (CVE-2025-8035, CVE-2025-8034), incorrect URL stripping in CSP reports (CVE-2025-8031), partial return value writes in the JavaScript engine stack (CVE-2025-8027), potential user-assisted code execution via the 'Copy as cURL' command (CVE-2025-8030), incorrect JavaScript state machine behavior for generators (CVE-2025-8033), XSLT documents bypassing CSP (CVE-2025-8032), and execution of javascript: URLs on object and embed tags (CVE-2025-8029). The advisory provides updated Thunderbird packages to remediate these vulnerabilities.

The vulnerabilities collectively impact the security of Mozilla Thunderbird by enabling potential memory corruption, code execution, bypass of content security policies, and improper handling of JavaScript execution contexts. These issues could allow an attacker to execute arbitrary code, bypass security restrictions, or cause application instability. The advisory rates the overall impact as Important (high severity). No known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.6 that address all listed vulnerabilities. Users should apply these official updates promptly to remediate the security issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps beyond applying the vendor-provided update are indicated.