This Red Hat security advisory addresses five vulnerabilities affecting Mozilla Thunderbird and Firefox components integrated within it. The issues include CVE-2025-9182 (denial-of-service via out-of-memory in WebRender), CVE-2025-9179 (sandbox escape due to invalid pointer in GMP), CVE-2025-9180 (same-origin policy bypass in Canvas2D), CVE-2025-9181 (uninitialized memory in the JavaScript Engine), and CVE-2025-9185 (memory safety bugs fixed in multiple ESR and standard releases). These vulnerabilities impact the security boundaries and memory safety of Thunderbird, potentially allowing denial-of-service, sandbox escape, and policy bypass. The fixes are included in Thunderbird ESR 128.14 and later versions as per Red Hat's advisory RHSA-2025:15435.

The vulnerabilities collectively could lead to denial-of-service conditions, sandbox escapes, bypass of same-origin policy, and memory safety issues within Thunderbird. These issues may undermine the security model of the application, potentially allowing attackers to execute unauthorized actions or cause application crashes. However, there are no known exploits in the wild at this time. The advisory rates the impact as important (high severity).

An official security update is available from Red Hat addressing these vulnerabilities in Thunderbird ESR 128.14 and later. Users should apply the Thunderbird update provided by Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions or other relevant Red Hat channels as soon as possible. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigations are specified beyond applying the official update.