This Red Hat security advisory (RHSA-2026:0025) addresses multiple vulnerabilities in Mozilla Thunderbird, including use-after-free in the WebRTC signaling component (CVE-2025-14321), memory safety bugs (CVE-2025-14333), sandbox escape due to incorrect boundary conditions in the CanvasWebGL component (CVE-2025-14322), privilege escalation in the Netmonitor and DOM Notifications components (CVE-2025-14323, CVE-2025-14328, CVE-2025-14329), same-origin policy bypass in the Request Handling component (CVE-2025-14331), and several JIT miscompilation issues in the JavaScript engine (CVE-2025-14324, CVE-2025-14325, CVE-2025-14330). These vulnerabilities affect Thunderbird ESR 140.6 and Thunderbird 146 versions. The advisory provides updated packages for Red Hat Enterprise Linux 10 across multiple architectures. No CVSS scores are provided in the advisory, but the overall impact is rated as important/high by Red Hat.

The vulnerabilities collectively could allow attackers to execute arbitrary code, escalate privileges, bypass security policies such as the same-origin policy, and escape sandbox restrictions within Mozilla Thunderbird. These issues affect core components such as WebRTC, graphics rendering, JavaScript engine, and network monitoring, potentially compromising confidentiality, integrity, and availability of the affected systems. The advisory rates the security impact as important, indicating significant risk if unpatched.

Red Hat has released updated Thunderbird packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and its variants should apply the Thunderbird update to version 140.6.0-1.el10_1 or later as provided by the Red Hat advisory RHSA-2026:0025. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed as fixed in the updated packages.