This Red Hat security advisory addresses seven distinct vulnerabilities in Mozilla Thunderbird, including sandbox escapes (CVE-2025-10527, CVE-2025-10528), a same-origin policy bypass (CVE-2025-10529), memory safety bugs (CVE-2025-10537), information disclosure (CVE-2025-10536), incorrect boundary conditions in JavaScript garbage collection (CVE-2025-10532), and an integer overflow in the SVG component (CVE-2025-10533). These vulnerabilities affect the Graphics Canvas2D, Layout, JavaScript GC, Networking Cache, and SVG components of Thunderbird. The issues are fixed in Thunderbird ESR 140.3 and Thunderbird 143, with patches provided by Red Hat for their Enterprise Linux 8.2 distribution. The advisory references multiple bugzilla entries and CVEs for detailed technical information.

Successful exploitation of these vulnerabilities could allow attackers to escape the sandbox environment, bypass same-origin policy restrictions, cause memory safety issues, disclose sensitive information, or trigger integer overflows within the affected components of Thunderbird. This could potentially lead to unauthorized code execution or information leakage. Red Hat rates the overall security impact as Important, indicating a high risk to affected systems if unpatched.

Red Hat has released an official security update for Thunderbird in Red Hat Enterprise Linux 8.2 (Advanced Update Support) that addresses all listed vulnerabilities. Users should apply the Thunderbird update to version 140.3.0-1.el8_2 or later as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.