This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird related to Firefox components. The issues include memory safety bugs (CVE-2025-11714, CVE-2025-11715), out-of-bounds read/write in privileged processes triggered by WebGL textures (CVE-2025-11709), cross-process information leaks due to malicious IPC messages (CVE-2025-11710), use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708), an OBJECT tag type attribute overriding browser behavior on web resources without a content-type (CVE-2025-11712), and modification of some non-writable Object properties (CVE-2025-11711). These vulnerabilities affect Red Hat Enterprise Linux 10 and related extended update support versions. The fixes are included in Thunderbird ESR 140.4 and Thunderbird 144 packages provided by Red Hat.

The vulnerabilities could lead to memory corruption, information disclosure, and potential privilege escalation within the Thunderbird mail client. Specifically, out-of-bounds read/write and use-after-free bugs may cause crashes or arbitrary code execution. Cross-process information leaks could expose sensitive data. Modification of non-writable properties and improper handling of OBJECT tags could affect application behavior and security. Red Hat rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Thunderbird packages (version 140.4.0-2.el10_0 and related) for Red Hat Enterprise Linux 10 and its extended update support variants. Users should apply these official updates promptly to remediate the vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the vendor-provided patches.