This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 9. The issues include a use-after-free vulnerability in libpng (CVE-2026-33416) leading to arbitrary code execution, out-of-bounds read/write in libpng's Neon palette expansion causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs (CVE-2026-5731, CVE-2026-5734), and an integer overflow with incorrect boundary conditions in the graphics text component (CVE-2026-5732). These vulnerabilities are fixed in Firefox ESR 140.9.1 and Firefox 149.0.2, as well as corresponding Thunderbird versions. The advisory provides updated packages for Red Hat Enterprise Linux 9 across multiple architectures.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause denial of service, or disclose sensitive information via the affected components in Firefox and Thunderbird. The memory safety bugs and integer overflow could lead to crashes or potentially more severe impacts depending on exploitation. Red Hat rates the overall security impact as Important (high severity).

A security update is available and should be applied to affected Red Hat Enterprise Linux 9 systems. The update includes fixes for Firefox ESR 140.9.1 and related packages. Users should follow Red Hat's official guidance to apply the update as detailed in the advisory (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the provided patches.