This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Firefox and Thunderbird components included in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The vulnerabilities include: CVE-2026-33416, a use-after-free in libpng leading to arbitrary code execution; CVE-2026-33636, an out-of-bounds read/write in libpng causing information disclosure and denial of service; CVE-2026-5734 and CVE-2026-5731, memory safety bugs fixed in Firefox ESR 140.9.1 and Thunderbird ESR 140.9.1; and CVE-2026-5732, an integer overflow in the graphics text component. These issues affect multiple architectures including x86_64, s390x, ppc64, and ppc64le. Red Hat has released updated Firefox packages (version 140.9.1-2.el7_9) to address these vulnerabilities. The advisory references Red Hat Bugzilla entries for each CVE and provides package downloads for remediation.

The vulnerabilities fixed include arbitrary code execution, information disclosure, denial of service, and memory safety issues in Firefox and Thunderbird components. Exploitation could allow attackers to execute code, access sensitive information, or cause application crashes. The impact is rated as Important by Red Hat, indicating a high risk to affected systems if unpatched. No known exploits in the wild have been reported at the time of this advisory.

Red Hat has released updated Firefox packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the issues. Detailed update instructions are available in the Red Hat advisory article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated beyond applying the provided patches.