This Red Hat security advisory addresses several vulnerabilities in Mozilla Firefox and Thunderbird components distributed with Red Hat Enterprise Linux 8.6. The issues include a use-after-free vulnerability in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the graphics text component (CVE-2026-5732). These vulnerabilities have been fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2 packages provided by Red Hat. The advisory includes updated RPM packages for Red Hat Enterprise Linux 8.6 variants and Power LE architectures. The vendor rates the security impact as Important and recommends applying the updates as detailed in their advisory.

The vulnerabilities include arbitrary code execution, information disclosure, denial of service, memory safety bugs, and integer overflow issues affecting Firefox and Thunderbird components. Exploitation could allow attackers to execute code, cause application crashes, or leak sensitive information. The impact is significant enough for Red Hat to classify the update as Important. No known exploits in the wild have been reported at this time.

Red Hat has released updated Firefox and Thunderbird packages (e.g., firefox-140.9.1-1.el8_6) for Red Hat Enterprise Linux 8.6 variants that address these vulnerabilities. Users should apply these official updates promptly following Red Hat's guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated beyond applying the vendor-provided patches.