This advisory covers several security fixes in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 8.2. Key vulnerabilities include CVE-2026-33416, a use-after-free in libpng leading to arbitrary code execution; CVE-2026-33636, an out-of-bounds read/write in libpng causing information disclosure and denial of service; CVE-2026-5731 and CVE-2026-5734, memory safety bugs fixed in Firefox ESR 140.9.1 and Thunderbird ESR 140.9.1; and CVE-2026-5732, an integer overflow in the graphics text component. These issues affect Firefox versions 140.9.1 and 149.0.2 and Thunderbird versions 140.9.1 and 149.0.2. Red Hat has released updated packages to address these vulnerabilities.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause denial of service, or disclose sensitive information on affected systems running vulnerable versions of Firefox or Thunderbird. The vulnerabilities affect memory safety and boundary conditions, which can lead to serious security consequences if exploited. Red Hat rates the security impact of this update as Important (high severity). There are no known exploits in the wild at the time of this advisory.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 8.2 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory (RHSA-2026:11805) and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official update.