This advisory covers several security fixes for Mozilla Firefox and Thunderbird as packaged by Red Hat for Red Hat Enterprise Linux 8.2. The vulnerabilities include CVE-2026-33416 (libpng use-after-free leading to arbitrary code execution), CVE-2026-33636 (libpng out-of-bounds read/write causing information disclosure and denial of service), CVE-2026-5731 and CVE-2026-5734 (memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2), and CVE-2026-5732 (incorrect boundary conditions and integer overflow in the graphics text component). These issues affect Firefox ESR versions prior to 140.9.1 and related Thunderbird versions. Red Hat has issued patches to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could allow arbitrary code execution, information disclosure, denial of service, and memory safety violations in affected Firefox and Thunderbird versions. This could compromise the confidentiality, integrity, and availability of the affected systems running Red Hat Enterprise Linux 8.2 with vulnerable Firefox packages.

A security update is available from Red Hat for Firefox and Thunderbird packages in Red Hat Enterprise Linux 8.2. Users should apply the update to Firefox ESR 140.9.1 or later and Thunderbird ESR 140.9.1 or later to remediate these vulnerabilities. Refer to the Red Hat advisory RHSA-2026:11805 and the article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigations are indicated by the vendor.