Mozilla Thunderbird contains a vulnerability in the libexpat XML parsing library that allows denial of service via crafted XML input (CVE-2026-45186). This security issue is addressed in Thunderbird version 153.5.0-1.el10_2.alma.1 and later. The update also includes bug fixes and enhancements related to the Thunderbird ESR 153 rebase for Red Hat Enterprise Linux 10.2 Extended Update Support.