Security update for MozillaThunderbird

The update to Mozilla Thunderbird 128.8 (MFSA 2025-18) fixes a range of security issues: an overflow when growing an SkRegion's RunArray (CVE-2024-43097); use-after-free vulnerabilities in AudioIPC StreamData (CVE-2025-1930) and WebTransportChild (CVE-2025-1931); an out-of-bounds access due to an inconsistent comparator in XSLT sorting (CVE-2025-1932); JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933); unexpected garbage collection during RegExp bailout processing (CVE-2025-1934); a clickjacking vulnerability involving the registerProtocolHandler info-bar (CVE-2025-1935); manipulation of jar: URL contents via %00 and fake extensions (CVE-2025-1936); multiple memory safety bugs fixed in Thunderbird 128.8 (CVE-2025-1937, CVE-2025-1938); and issues with OpenPGP key downloading and email encryption display (CVE-2025-26695, CVE-2025-26696). The update also improves performance and fixes UI issues unrelated to security.

These vulnerabilities collectively pose risks including potential memory corruption, use-after-free conditions that could lead to crashes or code execution, out-of-bounds memory access, and UI-based attacks such as clickjacking. The issues fixed affect core components of Thunderbird, including rendering, audio processing, and cryptographic key handling, potentially impacting confidentiality, integrity, and availability of the application.

Users should update to Mozilla Thunderbird version 128.8 or later to apply all listed security fixes. This update is an official fix addressing multiple vulnerabilities. No additional mitigation steps are indicated beyond applying the update.