This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Firefox and associated libraries on Red Hat Enterprise Linux 9. The vulnerabilities include a use-after-free in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng causing information disclosure and denial of service (CVE-2026-33636), memory safety bugs in Firefox and Thunderbird (CVE-2026-5731 and CVE-2026-5734), and an integer overflow in the Graphics: Text component (CVE-2026-5732). These issues have been fixed in Firefox ESR 140.9.1 and Firefox 149.0.2 packages provided by Red Hat. The advisory rates the security impact as Important (high severity) and provides updated packages for multiple architectures. No known exploits in the wild have been reported at the time of this advisory.

The vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information due to memory safety issues and integer overflow bugs in Firefox and libpng. Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Firefox versions on Red Hat Enterprise Linux 9. However, no known exploits in the wild have been reported.

Red Hat has released updated Firefox packages (version 140.9.1-1.el9_7 and later) for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the vendor-provided update fully mitigates the vulnerabilities.