Red Hat Product Security issued an advisory (RHSA-2025:8326) for Mozilla Thunderbird in Red Hat Enterprise Linux 9.2 Extended Update Support addressing four security issues: CVE-2025-3909 (JavaScript execution via spoofed PDF attachments and file:/// links), CVE-2025-3875 (sender spoofing via malformed From header), CVE-2025-3877 (unsolicited file download, disk space exhaustion, and credential leakage via mailbox:/// links), and CVE-2025-3932 (tracking links in attachments bypassing remote content blocking). These vulnerabilities could allow attackers to execute JavaScript, spoof sender information, cause unsolicited downloads and resource exhaustion, and bypass content blocking mechanisms. Red Hat has released updated Thunderbird packages (version 128.10.1-1.el9_2) to address these issues. The advisory does not provide CVSS scores but rates the update as important.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary JavaScript code via crafted PDF attachments, spoof sender information in emails, cause unsolicited file downloads leading to disk space exhaustion and potential credential leakage, and bypass remote content blocking via tracking links in attachments. These impacts could compromise user privacy, system resources, and trust in email communications. However, no known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages (version 128.10.1-1.el9_2) that fix the identified vulnerabilities. Users of Red Hat Enterprise Linux 9.2 Extended Update Support should apply the provided security update promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation actions are indicated by the vendor advisory.