MozillaThunderbird-140.13.0-1.1 on GA media

This advisory covers a broad set of security vulnerabilities in Mozilla Thunderbird, fixed in versions 140.13 and 153. The flaws include an off-by-one out-of-bounds read in the MIME header parser (CVE-2026-14899), invalid pointer dereferences, site isolation issues, sandbox escapes due to use-after-free bugs, JIT miscompilations, privilege escalations, mitigation bypasses, and information disclosures in multiple components such as DOM navigation, JavaScript WebAssembly, Audio/Video (cubeb and GMP), Networking (HTTP, DNS, WebSockets), Storage (IndexedDB), and Graphics (WebGPU, ImageLib). Some vulnerabilities have publicly available exploit code, but no known in-the-wild exploitation has been reported. The vulnerabilities are mitigated by disabling scripting when reading mail, limiting direct exploitation via email. Red Hat's security update addresses these issues in Thunderbird versions prior to 140.13 and 153, including their Enterprise Linux AppStream versions 8, 9, and 10 on ppc64le architecture.

The vulnerabilities collectively pose high to critical impact risks including potential arbitrary code execution, sandbox escapes, privilege escalation, information disclosure, and denial-of-service conditions. While direct exploitation through email is generally not feasible due to disabled scripting, the vulnerabilities present significant risks in browser or browser-like contexts where scripting is enabled. Some flaws have publicly available exploit code, increasing the risk of exploitation if the environment permits. The off-by-one error in MIME header parsing can cause crashes. Memory safety bugs could lead to arbitrary code execution with sufficient effort. Overall, these vulnerabilities threaten confidentiality, integrity, and availability of the affected Thunderbird installations.

A security update fixing these vulnerabilities is available and should be applied. Red Hat has released Thunderbird version 140.13 and Mozilla has released Thunderbird 153 which address these issues. Users should upgrade to these fixed versions as soon as possible. Since scripting is disabled when reading mail in Thunderbird, the risk of exploitation through email is low. No additional mitigations are explicitly required beyond applying the official updates.