This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird, including CVE-2026-33416 (libpng use-after-free leading to arbitrary code execution), CVE-2026-33636 (libpng out-of-bounds read/write causing information disclosure and denial of service), CVE-2026-5731 and CVE-2026-5734 (memory safety bugs), and CVE-2026-5732 (integer overflow in graphics text component). These vulnerabilities affect Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2. Red Hat has released updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support to fix these issues. The advisory references multiple bugzilla entries and provides package updates for various architectures. No CVSS scores are provided in the advisory, but the impact is rated as Important by Red Hat.

The vulnerabilities include arbitrary code execution, information disclosure, denial of service, memory safety issues, and integer overflow, which could allow attackers to execute code, leak sensitive information, or cause application crashes. These issues affect Firefox and Thunderbird versions distributed with Red Hat Enterprise Linux 9.4 Extended Update Support. Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems running these versions.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security updates as detailed in the Red Hat advisory RHSA-2026:13582 and the associated article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patches.