Red Hat Security Advisory: thunderbird security update
A security update for Mozilla Thunderbird addresses multiple vulnerabilities including unsolicited file download, disk space exhaustion, and credential leakage via mailbox:/// links. These issues are tracked under CVE-2025-5986 and related CVEs. The vulnerabilities affect Red Hat Enterprise Linux Server 8.2 AUS x86_64. Red Hat has released updated Thunderbird packages to remediate these issues.
AI Analysis
Technical Summary
Multiple security vulnerabilities in Mozilla Thunderbird, as packaged for Red Hat Enterprise Linux 8.2 AUS, allow unsolicited file downloads, disk space exhaustion, and credential leakage via mailbox:/// links. These issues are identified under CVE-2025-5986 and additional CVEs (CVE-2025-6424, CVE-2025-6425, CVE-2025-6429, CVE-2025-6430). Red Hat Product Security has issued an important security advisory (RHSA-2025:10166) providing updated Thunderbird packages to fix these vulnerabilities.
Potential Impact
Successful exploitation could lead to unauthorized file downloads, exhaustion of disk space resources, and leakage of user credentials. This could compromise user data confidentiality and system stability on affected Red Hat Enterprise Linux 8.2 AUS systems running Thunderbird.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 128.12.0-1.el8_2) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:10166 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the official patch.
Red Hat Security Advisory: thunderbird security update
Description
A security update for Mozilla Thunderbird addresses multiple vulnerabilities including unsolicited file download, disk space exhaustion, and credential leakage via mailbox:/// links. These issues are tracked under CVE-2025-5986 and related CVEs. The vulnerabilities affect Red Hat Enterprise Linux Server 8.2 AUS x86_64. Red Hat has released updated Thunderbird packages to remediate these issues.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Multiple security vulnerabilities in Mozilla Thunderbird, as packaged for Red Hat Enterprise Linux 8.2 AUS, allow unsolicited file downloads, disk space exhaustion, and credential leakage via mailbox:/// links. These issues are identified under CVE-2025-5986 and additional CVEs (CVE-2025-6424, CVE-2025-6425, CVE-2025-6429, CVE-2025-6430). Red Hat Product Security has issued an important security advisory (RHSA-2025:10166) providing updated Thunderbird packages to fix these vulnerabilities.
Potential Impact
Successful exploitation could lead to unauthorized file downloads, exhaustion of disk space resources, and leakage of user credentials. This could compromise user data confidentiality and system stability on affected Red Hat Enterprise Linux 8.2 AUS systems running Thunderbird.
Mitigation Recommendations
Red Hat has released updated Thunderbird packages (version 128.12.0-1.el8_2) that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2025:10166 and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the official patch.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:10166
- Cve Count
- 5
- Additional Cves
- ["CVE-2025-6424","CVE-2025-6425","CVE-2025-6429","CVE-2025-6430"]
Threat ID: 6a419cba27e9c79719abeb14
Added to database: 06/28/2026, 22:14:18 UTC
Last enriched: 06/28/2026, 22:35:19 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 39
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.