Red Hat Product Security issued an advisory (RHSA-2025:8642) for Mozilla Thunderbird addressing nine CVEs related to memory safety and security issues. The vulnerabilities include out-of-bounds access when resolving Promise objects (CVE-2025-4918) and optimizing linear sums (CVE-2025-4919), a clickjacking vulnerability that could leak saved payment card details (CVE-2025-5267), potential local code execution via the 'Copy as cURL' command (CVE-2025-5264), multiple memory safety bugs (CVE-2025-5268, CVE-2025-5269), leakage of cross-origin resource status through script element events (CVE-2025-5266), and incorrect isolation of error handling for script execution from web content (CVE-2025-5263). These issues affect Thunderbird as distributed in Red Hat Enterprise Linux 9.2 and related variants. Red Hat has released patched packages to address these vulnerabilities.

The vulnerabilities collectively could allow attackers to cause out-of-bounds memory access, potentially leading to crashes or arbitrary code execution. The clickjacking flaw could expose saved payment card details, risking user financial data leakage. Local code execution is possible through the 'Copy as cURL' feature. Memory safety bugs and improper script isolation increase the risk of exploitation through crafted content. These issues pose a high security risk to users of affected Thunderbird versions on Red Hat Enterprise Linux 9.2.

Red Hat has released an official security update for Thunderbird (version 128.11.0-1.el9_2) that addresses all listed vulnerabilities. Users of Red Hat Enterprise Linux 9.2 and related variants should apply this update promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the official patch.