This Red Hat security advisory addresses several vulnerabilities in Mozilla Thunderbird and associated libraries. CVE-2026-33416 is a use-after-free vulnerability in libpng that could lead to arbitrary code execution. CVE-2026-33636 involves information disclosure and denial of service through out-of-bounds read/write in libpng's Neon palette expansion. CVE-2026-5731 and CVE-2026-5734 are memory safety bugs fixed in Thunderbird ESR 140.9.1 and Firefox ESR 140.9.1 and later versions. CVE-2026-5732 is an integer overflow vulnerability in the graphics text component affecting Firefox and Thunderbird. The advisory covers fixes applied in Thunderbird version 140.9.1-1.el8_10 for Red Hat Enterprise Linux 8 and its Extended Life Cycle variants across multiple architectures. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause denial of service, or disclose sensitive information through memory safety issues and out-of-bounds memory access. The integer overflow could lead to incorrect boundary handling in graphics rendering. These issues affect the Thunderbird mail client and its dependencies, potentially impacting the confidentiality, integrity, and availability of affected systems.

Red Hat has released updated Thunderbird packages for Red Hat Enterprise Linux 8 and its Extended Life Cycle variants that address these vulnerabilities. Users should apply the Thunderbird update to version 140.9.1-1.el8_10 or later as provided by Red Hat to remediate these issues. Refer to Red Hat's official advisory RHSA-2026:9345 and article https://access.redhat.com/articles/11258 for detailed update instructions. No additional mitigation steps are indicated beyond applying the official update.