This advisory covers several security vulnerabilities in Mozilla Firefox and Thunderbird as packaged by Red Hat for RHEL 9.4 EUS. The issues include a use-after-free vulnerability in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the Graphics: Text component (CVE-2026-5732). These vulnerabilities affect Firefox ESR versions prior to 140.9.1 and related Thunderbird versions. Red Hat has issued updated packages (e.g., firefox-140.9.1-1.el9_4) that fix these issues.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause denial of service, or disclose sensitive information via the affected Firefox and Thunderbird versions. The memory safety bugs and integer overflow could lead to crashes or potentially more severe impacts depending on exploitation. The advisory rates the security impact as Important (high severity).

Red Hat has released security updates for Firefox and Thunderbird in RHEL 9.4 EUS to address these vulnerabilities. Users should apply the provided updates (e.g., firefox-140.9.1-1.el9_4) as soon as possible. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation is required beyond applying the official patches.