This Red Hat security advisory addresses multiple vulnerabilities in Thunderbird for RHEL 9, including high-severity issues like use-after-free in the JavaScript Engine (CVE-2026-6754, CVSS 7.5) and incorrect boundary conditions in NSS Libraries (CVE-2026-6772, CVSS 7.5), which can lead to arbitrary code execution or information disclosure. Affected versions are Thunderbird ESR prior to 140.10.0, as detailed in the NVD data. The update provides patches to remediate these vulnerabilities; users should apply the Thunderbird security update provided by Red Hat to the fixed versions specified in the advisory.
Red Hat Product Errata RHSA-2026:15892 - Security Advisory Issued: 2026-05-11 Updated: 2026-05-11 RHSA-2026:15892 - Security Advisory Overview Updated Packages Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for thunderbird is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772) firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754) firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-6762) firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752) firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770) firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757) firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767) firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786) firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753) firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759) firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747) firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749) firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766) firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761) firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763) firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750) firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748) firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785) firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771) firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764) firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765) firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769) firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751) firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776) firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-6746) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Fixes BZ - 2460074 - CVE-2026-6772 firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS BZ - 2460075 - CVE-2026-6754 firefox: thunderbird: Use-after-free in the JavaScript Engine component BZ - 2460076 - CVE-2026-6762 firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component BZ - 2460078 - CVE-2026-6752 firefox: thunderbird: Incorrect boundary conditions in the WebRTC component BZ - 2460079 - CVE-2026-6770 firefox: thunderbird: Other issue in the Storage: IndexedDB component BZ - 2460085 - CVE-2026-6757 firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component BZ - 2460086 - CVE-2026-6767 firefox: thunderbird: Other issue in the Libraries component in NSS BZ - 2460088 - CVE-2026-6786 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 BZ - 2460092 - CVE-2026-6753 firefox: thunderbird: Incorrect boundary conditions in the WebRTC component BZ - 2460094 - CVE-2026-6759 firefox: thunderbird: Use-after-free in the Widget: Cocoa component BZ - 2460095 - CVE-2026-6747 firefox: thunderbird: Use-after-free in the WebRTC component BZ - 2460096 - CVE-2026-6749 firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component BZ - 2460097 - CVE-2026-6766 firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS BZ - 2460099 - CVE-2026-6761 firefox: thunderbird: Privilege escalation in the Networking component BZ - 2460101 - CVE-2026-6763 firefox: thunderbird: Mitigation bypass in the File Handling component BZ - 2460102 - CVE-2026-6750 firefox: thunderbird: Privilege escalation in the Graphics: WebRender component BZ - 2460103 - CVE-2026-6748 firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component BZ - 2460104 - CVE-2026-6785 firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 BZ - 2460105 - CVE-2026-6771 firefox: thunderbird: Mitigation bypass in the DOM: Security component BZ - 2460106 - CVE-2026-6764 firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component BZ - 2460107 - CVE-2026-6765 firefox: thunderbird: Information disclosure in the Form Autofill component BZ - 2460108 - CVE-2026-6769 firefox: thunderbird: Privilege escalation in the Debugger component BZ - 2460109 - CVE-2026-6751 firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component BZ - 2460110 - CVE-2026-6776 firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component BZ - 2460112 - CVE-2026-6746 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component CVEs CVE-2026-6746 CVE-2026-6747 CVE-2026-6748 CVE-2026-6749 CVE-2026-6750 CVE-2026-6751 CVE-2026-6752 CVE-2026-6753 CVE-2026-6754 CVE-2026-6757 CVE-2026-6759 CVE-2026-6761 CVE-2026-6762 CVE-2026-6763 CVE-2026-6764 CVE-2026-6765 CVE-2026-6766 CVE-2026-6767 CVE-2026-6769 CVE-2026-6770 CVE-2026-6771 CVE-2026-6772 CVE-2026-6776 CVE-2026-6785 CVE-2026-6786 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM thunderbird-140.10.0-1.el9_7.src.rpm SHA-256: 1569ce6dbaba23ec5977cc53b1fc05f6b4b25a69e3529bfc82d70b1231d21646 x86_64 thunderbird-140.10.0-1.el9_7.x86_64.rpm SHA-256: bcae2cf79a6bff392bfbb25a8e7b21b1de1ad67d52f107be64ad063c79f482fb thunderbird-debuginfo-140.10.0-1.el9_7.x86_64.rpm SHA-256: 159d249480a4be30f9b56a796676811cb7a515be44b9aec197d6cfd8eecfdcad thunderbird-debugsource-140.10.0-1.el9_7.x86_64.rpm SHA-256: 6c56f6b35859229a0e697f4d6d363eae63a660f4786a140f42a563a1f12a97f7 Red Hat Enterprise Linux for IBM z Systems 9 SRPM thunderbird-140.10.0-1.el9_7.src.rpm SHA-256: 1569ce6dbaba23ec5977cc53b1fc05f6b4b25a69e3529bfc82d70b1231d21646 s390x thunderbird-140.10.0-1.el9_7.s390x.rpm SHA-256: aacb39c2de4fd3e799ebf81a106629ef8a749654fb421081bbc044f6f659025c thunderbird-debuginfo-140.10.0-1.el9_7.s390x.rpm SHA-256: 7f2c28ad3076546280bab47e1f9641c795b2363506d55032a29a7e9be9550571 thunderbird-debugsource-140.10.0-1.el9_7.s390x.rpm SHA-256: c0e79b684908ac0df2d5ba70dea986925d12d9d33fd5c06511fc10bb14957adb Red Hat Enterprise Linux for Power, little endian 9 SRPM thunderbird-140.10.0-1.el9_7.src.rpm SHA-256: 1569ce6dbaba23ec5977cc53b1fc05f6b4b25a69e3529bfc82d70b1231d21646 ppc64le thunderbird-140.10.0-1.el9_7.ppc64le.rpm SHA-256: 27d6271b59a5660398b8c9b41b4c77ebcb53ef8171691123545c344131952388 thunderbird-debuginfo-140.10.0-1.el9_7.ppc64le.rpm SHA-256: 7ffe9840c5375ff54a9868298e5e5d09daa06f0e1a37cb4222465673a72460c8 thunderbird-debugsource-140.10.0-1.el9_7.ppc64le.rpm SHA-256: 313478e78fe750a65f5fcf78e989e307ef86f770710d7f7460df0c54918dca6f Red Hat Enterprise Linux for ARM 64 9 SRPM thunderbird-140.10.0-1.el9_7.src.rpm SHA-256: 1569ce6dbaba23ec5977cc53b1fc05f6b4b25a69e3529bfc82d70b1231d21646 aarch64 thunderbird-140.10.0-1.el9_7.aarch64.rpm SHA-256: ac61cc1737c21f2de702c82a809c6af8847a306af26795600fa2481924d19c11 thunderbird-debuginfo-140.10.0-1.el9_7.aarch64.rpm SHA-256: d52e576e0002ab20a6684ed2f3491ba9fd316cf49b5f182be8bdb04c0088e30d thunderbird-debugsource-140.10.0-1.el9_7.aarch64.rpm SHA-256: 9409600ef286ae355964a44d9e3d2d70fa90d8fba34319ec730577155c5e57d9 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .