This Red Hat security advisory (RHSA-2026:0924) addresses a set of 13 vulnerabilities affecting Mozilla Thunderbird and related Firefox components integrated into Thunderbird. The issues include a spoofing vulnerability in the Downloads Panel (CVE-2025-14327), multiple use-after-free bugs in JavaScript GC, IPC, and JavaScript Engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in the DOM security component (CVE-2026-0877), and spoofing and clickjacking issues in DOM copy & paste, drag & drop components (CVE-2026-0890). These vulnerabilities are fixed in Thunderbird ESR 140.7 and Thunderbird 147. The advisory applies to Red Hat Enterprise Linux 9 and its extended update support versions.

The vulnerabilities collectively pose risks including spoofing attacks, memory corruption leading to potential code execution or crashes, sandbox escapes that could allow attackers to break out of restricted environments, information disclosure of sensitive data, mitigation bypasses that weaken security controls, and clickjacking attacks. The Red Hat advisory rates the overall impact as important, indicating significant security concerns that could affect confidentiality, integrity, and availability of the affected systems running Thunderbird on Red Hat Enterprise Linux 9.

An official security update is available from Red Hat that addresses all listed vulnerabilities. Users and administrators should apply the Thunderbird update provided in Red Hat Enterprise Linux 9 and its variants as detailed in advisory RHSA-2026:0924. The update includes Thunderbird ESR 140.7. No additional mitigation steps are indicated by the vendor beyond applying this update.