This Red Hat security advisory addresses a set of 13 vulnerabilities impacting Mozilla Thunderbird, as packaged for Red Hat Enterprise Linux 8.4. The vulnerabilities include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in Graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in Networking and PDF Viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These issues have been fixed in Thunderbird ESR 140.7 and Thunderbird 147. The advisory is rated as Important by Red Hat Product Security and affects Red Hat Enterprise Linux 8.4 variants.

The vulnerabilities collectively pose risks including spoofing, memory corruption (use-after-free), sandbox escape, information disclosure, mitigation bypass, and clickjacking. These could potentially allow attackers to bypass security controls, execute arbitrary code, disclose sensitive information, or trick users via spoofing or clickjacking. The advisory does not report known exploits in the wild. The severity is assessed as high due to the range and nature of the issues fixed.

Red Hat has released an official security update for Thunderbird in Red Hat Enterprise Linux 8.4 (including Advanced Mission Critical Update Support and Extended Update Support). Users should apply the Thunderbird update to version 140.7.0-1.el8_4 or later as provided by Red Hat to remediate these vulnerabilities. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.