This Red Hat security advisory (RHSA-2026:1461) covers a set of 13 vulnerabilities affecting Mozilla Thunderbird, as packaged for Red Hat Enterprise Linux 8.4. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These vulnerabilities are addressed by updates to Thunderbird ESR 140.7 and Thunderbird 147, as well as Firefox ESR 140.7 and Firefox 147. The advisory provides updated packages for Red Hat Enterprise Linux 8.4 AUS and EUS extensions. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities collectively could allow attackers to perform spoofing, execute arbitrary code via use-after-free bugs, escape sandbox restrictions, disclose sensitive information, bypass security mitigations, and perform clickjacking attacks. These issues affect core components of Thunderbird and Firefox, potentially impacting the confidentiality, integrity, and security of the mail client environment. However, no active exploitation has been reported.

Red Hat has released updated Thunderbird packages (version 140.7.0-1.el8_4) for Red Hat Enterprise Linux 8.4 AUS and EUS extensions that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. For detailed update instructions, refer to the Red Hat article at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update is the recommended mitigation. No additional vendor-recommended mitigations or workarounds are indicated.