This advisory covers several security issues in Mozilla Firefox and Thunderbird as packaged by Red Hat for Enterprise Linux 8.6. The vulnerabilities include a use-after-free in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2 (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the graphics text component (CVE-2026-5732). Red Hat has released updated packages to address these issues.

The vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information due to memory safety bugs and integer overflow conditions in Firefox and Thunderbird. The issues affect the graphical and image processing components, which could be triggered by maliciously crafted content. Red Hat rates the security impact as Important, indicating a high severity level but no confirmed active exploitation in the wild.

Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 8.6 that fix these vulnerabilities. Users should apply the provided security updates (e.g., firefox-140.9.1-1.el8_6) as soon as possible to remediate the issues. For detailed update instructions, refer to Red Hat's official advisory and article at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.