This advisory covers four security vulnerabilities in Mozilla Thunderbird as packaged for Red Hat Enterprise Linux 8. The issues include memory safety bugs (CVE-2026-7322, CVE-2026-7323), an information disclosure vulnerability caused by incorrect boundary conditions in the Audio/Video component (CVE-2026-7320), and a sandbox escape vulnerability in the WebRTC networking component due to incorrect boundary conditions (CVE-2026-7321). These vulnerabilities were fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. The fixes are distributed via Red Hat security updates for multiple architectures and product variants. The advisory references Red Hat's errata RHSA-2026:20586 for detailed patching instructions.

Successful exploitation of these vulnerabilities could lead to memory safety issues, information disclosure, and sandbox escape within the Thunderbird mail client. This could potentially allow an attacker to access sensitive information or execute code outside the intended sandbox environment. However, no known exploits in the wild have been reported. The vulnerabilities affect multiple architectures and versions of Red Hat Enterprise Linux 8 Thunderbird packages.

Red Hat has released updated Thunderbird packages (version 140.10.1-1.el8_10 and later) that address these vulnerabilities. Users and administrators should apply these official security updates promptly to remediate the issues. Detailed update instructions are available in the Red Hat advisory RHSA-2026:20586 and the referenced article https://access.redhat.com/articles/11258. Since patches are available, applying the official fixes is the recommended mitigation.