This Red Hat security advisory addresses a set of 13 vulnerabilities impacting Mozilla Thunderbird, as packaged in Red Hat Enterprise Linux 8. The issues include spoofing (CVE-2025-14327, CVE-2026-0890), use-after-free bugs in JavaScript GC, IPC, and JavaScript engine components (CVE-2026-0885, CVE-2026-0882, CVE-2026-0884), memory safety bugs (CVE-2026-0891), sandbox escapes due to incorrect boundary conditions and integer overflow in graphics components (CVE-2026-0878, CVE-2026-0879, CVE-2026-0880, CVE-2026-0886), information disclosure in networking and PDF viewer components (CVE-2026-0883, CVE-2026-0887), mitigation bypass in DOM security (CVE-2026-0877), and clickjacking issues. These vulnerabilities are fixed in Thunderbird ESR 140.7 and Thunderbird 147, as well as Firefox ESR 140.7 and Firefox 147. The advisory covers multiple architectures supported by Red Hat Enterprise Linux 8.

The vulnerabilities collectively pose risks including spoofing, memory corruption leading to potential code execution or crashes, sandbox escapes that could allow attackers to break out of restricted environments, information disclosure that could leak sensitive data, mitigation bypasses reducing the effectiveness of security controls, and clickjacking attacks. These issues affect core components of Thunderbird and Firefox, potentially impacting confidentiality, integrity, and availability of the affected systems.

An official security update is available from Red Hat for Thunderbird on Red Hat Enterprise Linux 8, addressing all listed vulnerabilities. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these issues. No additional vendor advisories indicate that no action is required or that these issues are already mitigated by other means.