This advisory covers several security vulnerabilities fixed in Mozilla Firefox and Thunderbird as packaged for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issues include a use-after-free vulnerability in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the Graphics: Text component (CVE-2026-5732). These vulnerabilities affect Firefox ESR 140.9.1 and Thunderbird ESR 140.9.1, as well as Firefox 149.0.2 and Thunderbird 149.0.2 upstream. Red Hat has issued updated Firefox packages (version 140.9.1-2.el7_9) to address these issues.

Successful exploitation of these vulnerabilities could allow arbitrary code execution, information disclosure, denial of service, or memory corruption in affected Firefox and Thunderbird versions. The issues affect the libpng library and graphics components, which are critical for processing image and text data. The severity is rated as high by Red Hat Product Security, indicating significant risk if unpatched.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that fix these vulnerabilities. Users should apply the Firefox update to version 140.9.1-2.el7_9 or later as provided by Red Hat. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official update.