This Red Hat security advisory addresses five vulnerabilities in Mozilla Thunderbird and Firefox components integrated within Thunderbird. The issues include CVE-2025-9182 (denial-of-service via out-of-memory in Graphics WebRender), CVE-2025-9179 (sandbox escape due to invalid pointer in Audio/Video GMP), CVE-2025-9180 (same-origin policy bypass in Graphics Canvas2D), CVE-2025-9181 (uninitialized memory in JavaScript Engine), and CVE-2025-9185 (memory safety bugs fixed across multiple ESR and standard versions of Firefox and Thunderbird). Red Hat has released updated Thunderbird packages (version 128.14.0-3.el9_4) for Red Hat Enterprise Linux 9.4 Extended Update Support and related distributions to remediate these vulnerabilities.

The vulnerabilities collectively could allow denial-of-service conditions, sandbox escapes, bypass of same-origin policy, exposure of uninitialized memory, and other memory safety issues in Mozilla Thunderbird. These issues may lead to potential compromise of application security boundaries and stability. Red Hat rates the overall security impact as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Thunderbird packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.4 Extended Update Support and related variants should apply the Thunderbird update to version 128.14.0-3.el9_4 or later as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.