This advisory covers several security flaws in Mozilla Thunderbird and its dependencies, including libpng and Firefox components integrated into Thunderbird. The issues include a use-after-free vulnerability in libpng (CVE-2026-33416) leading to arbitrary code execution, out-of-bounds read/write in libpng's Neon palette expansion causing information disclosure and denial of service (CVE-2026-33636), multiple memory safety bugs fixed in Thunderbird ESR 140.9.1 and Firefox 149.0.2 (CVE-2026-5731, CVE-2026-5734), and an integer overflow in the Graphics: Text component (CVE-2026-5732). These vulnerabilities affect Thunderbird versions prior to 140.9.1 and are addressed by the Red Hat security update RHSA-2026:13412 for Red Hat Enterprise Linux 9.2.

The vulnerabilities collectively could allow attackers to execute arbitrary code, cause denial of service, or disclose sensitive information through memory safety errors and boundary condition flaws in Thunderbird and libpng. The severity is rated as high by Red Hat Product Security. No known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 9.2 that fix these vulnerabilities. Users should apply the security update RHSA-2026:13412 promptly to remediate the issues. For detailed update instructions, refer to Red Hat's official advisory and article https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor.