This advisory covers several security fixes in Mozilla Thunderbird and Firefox as packaged in Red Hat Enterprise Linux. Key vulnerabilities include a use-after-free leading to arbitrary code execution (CVE-2026-33416), out-of-bounds read/write causing information disclosure and denial of service (CVE-2026-33636), and multiple memory safety bugs (CVE-2026-5731, CVE-2026-5734). Additionally, an integer overflow and incorrect boundary condition in the graphics text component were addressed (CVE-2026-5732). These issues were resolved in Thunderbird ESR 140.9.1, Firefox ESR 140.9.1, Firefox 149.0.2, and Thunderbird 149.0.2. Red Hat Enterprise Linux 9 and 10 users should apply the provided updates to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution, information disclosure, denial of service, and memory safety violations in Thunderbird and Firefox. This could compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of these applications.

Red Hat has released security updates that fix these vulnerabilities in Thunderbird and Firefox for Red Hat Enterprise Linux 9 and 10. Users should apply the updates to Thunderbird ESR 140.9.1 and Firefox ESR 140.9.1 or later, as well as Firefox 149.0.2 and Thunderbird 149.0.2, as appropriate. Detailed update instructions are available in the Red Hat advisories and articles linked in the vendor advisory. No additional mitigations are required beyond applying these official patches.