Red Hat Security Advisory: thunderbird security update

Fixed packages 3

Vulnerabilities 13

• Critical 9.8
  CVE-2026-0879

  Sandbox escape due to incorrect boundary conditions in the Graphics component

  Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Critical 9.8
  CVE-2026-0884

  Use-after-free in the JavaScript Engine component

  Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.8
  CVE-2026-0880

  Sandbox escape due to integer overflow in the Graphics component

  Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.8
  CVE-2026-0882

  Use-after-free in the IPC component

  Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.1
  CVE-2026-0877

  Mitigation bypass in the DOM: Security component

  Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.1
  CVE-2026-0891

  Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147

  Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 8.0
  CVE-2026-0878

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

  Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• High 7.5
  CVE-2025-14327

  Spoofing issue in the Downloads Panel component

  Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Dec 9, 2025
• Medium 6.5
  CVE-2026-0885

  Use-after-free in the JavaScript: GC component

  Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.4
  CVE-2026-0890

  Spoofing issue in the DOM: Copy & Paste and Drag & Drop component

  Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.3
  CVE-2026-0883

  Information disclosure in the Networking component

  Information disclosure in the Networking component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 5.3
  CVE-2026-0886

  Incorrect boundary conditions in the Graphics component

  Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026
• Medium 4.3
  CVE-2026-0887

  Clickjacking issue, information disclosure in the PDF Viewer component

  Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Jan 13, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2420507
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428961
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428963
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428965
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428966
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428967
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428969
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428971
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428973
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428975
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428978
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0924.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14327
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14327
• article
  https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2025-14327
• article
  https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2025-14327
• report
  https://access.redhat.com/security/cve/CVE-2026-0877
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0877
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0877
• article
  https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0877
• article
  https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2026-0877
• report
  https://access.redhat.com/security/cve/CVE-2026-0878
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0878
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0878
• article
  https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0878
• article
  https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2026-0878
• report
  https://access.redhat.com/security/cve/CVE-2026-0879
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0879
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0879
• article
  https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0879
• article
  https://www.mozilla.org/security/advisories/mfsa2026-05/#CVE-2026-0879
• report
  https://access.redhat.com/security/cve/CVE-2026-0880
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0880
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0880
• article
  https://www.mozilla.org/security/advisories/mfsa2026-03/#CVE-2026-0880