This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird and associated libraries, including libpng. The issues fixed include a use-after-free vulnerability in libpng (CVE-2026-33416) that could lead to arbitrary code execution, an out-of-bounds read/write in libpng's Neon palette expansion causing information disclosure and denial of service (CVE-2026-33636), and multiple memory safety bugs in Thunderbird and Firefox ESR versions 140.9.1 and 149.0.2 (CVE-2026-5731, CVE-2026-5734). Additionally, an integer overflow and incorrect boundary conditions in the graphics text component were fixed (CVE-2026-5732). These fixes are included in Thunderbird ESR 140.9.1-1.el9_4 packages for Red Hat Enterprise Linux 9.4 variants.

The vulnerabilities could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information due to memory safety issues and integer overflow bugs in Thunderbird and libpng. Successful exploitation could compromise the confidentiality, integrity, and availability of affected systems running vulnerable Thunderbird versions on Red Hat Enterprise Linux 9.4. No known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages (version 140.9.1-1.el9_4) for Red Hat Enterprise Linux 9.4 that address these vulnerabilities. Users should apply the security update promptly by following Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.