This advisory covers five security vulnerabilities in Mozilla Thunderbird as packaged by Red Hat. The issues include a denial-of-service caused by out-of-memory in the Graphics WebRender component (CVE-2025-9182), a sandbox escape due to an invalid pointer in the Audio/Video GMP component (CVE-2025-9179), a same-origin policy bypass in the Graphics Canvas2D component (CVE-2025-9180), uninitialized memory usage in the JavaScript Engine component (CVE-2025-9181), and multiple memory safety bugs fixed in Thunderbird ESR 128.14 and 140.2, Firefox ESR 115.27, 128.14, 140.2, and Firefox 142 (CVE-2025-9185). Red Hat has issued updated Thunderbird packages for Red Hat Enterprise Linux 8.6 variants to remediate these vulnerabilities.

The vulnerabilities collectively could allow denial-of-service conditions, sandbox escapes, bypass of same-origin policy protections, and memory safety issues that may lead to crashes or potentially arbitrary code execution. These issues affect the security boundaries within Thunderbird, potentially impacting confidentiality, integrity, and availability of the application and user data.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:15535 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.