Red Hat Product Security issued an advisory (RHSA-2025:10164) for Mozilla Thunderbird on Red Hat Enterprise Linux 8.6 addressing several vulnerabilities, notably CVE-2025-5986 which involves unsolicited file downloads, disk space exhaustion, and credential leakage through mailbox:/// links. The advisory covers multiple CVEs (CVE-2025-5986, CVE-2025-6424, CVE-2025-6425, CVE-2025-6429, CVE-2025-6430) and provides updated Thunderbird packages (version 128.12.0-1.el8_6) for various Red Hat Enterprise Linux 8.6 product variants. The vulnerabilities relate to issues such as resource exhaustion (CWE-400), use-after-free (CWE-416), information exposure (CWE-200), improper input validation (CWE-706), and cross-site scripting (CWE-79).

Successful exploitation of CVE-2025-5986 can lead to unsolicited file downloads, exhaustion of disk space, and leakage of user credentials via specially crafted mailbox:/// links in Thunderbird. These vulnerabilities may compromise user data confidentiality and system stability. The advisory rates the security impact as Important, indicating a high severity level but no known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages (version 128.12.0-1.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the provided security update promptly following Red Hat's official guidance at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the described issues.