This Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird and related components. The vulnerabilities include a use-after-free in libpng leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write in libpng's Neon palette expansion causing information disclosure and denial of service (CVE-2026-33636), memory safety bugs fixed in Firefox ESR and Thunderbird ESR versions 140.9.1 and 149.0.2 (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the graphics text component affecting Firefox and Thunderbird (CVE-2026-5732). Red Hat Enterprise Linux 9.4 packages for Thunderbird have been updated to version 140.9.1-1.el9_4 to address these issues. The advisory references multiple bugzilla entries and provides updated RPM packages for various architectures. No known exploits in the wild have been reported. The update is classified as Important by Red Hat Product Security.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause denial of service, or disclose sensitive information on affected systems running vulnerable versions of Thunderbird and its dependencies. The vulnerabilities affect memory safety and boundary conditions, which can lead to crashes or code execution. The impact is rated as high severity by the source data.

Red Hat has released updated Thunderbird packages (version 140.9.1-1.el9_4) for Red Hat Enterprise Linux 9.4 and related variants that address these vulnerabilities. Users should apply the provided security updates promptly by following Red Hat's update instructions at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.