This advisory covers five security vulnerabilities impacting Mozilla Thunderbird and its dependencies, specifically libpng and Firefox components integrated with Thunderbird. CVE-2026-33416 is a use-after-free vulnerability in libpng that could lead to arbitrary code execution. CVE-2026-33636 involves information disclosure and denial of service via out-of-bounds read/write in libpng's Neon palette expansion. CVE-2026-5731 and CVE-2026-5734 are memory safety bugs fixed in Thunderbird ESR 140.9.1 and 149.0.2, as well as Firefox ESR 115.34.1, 140.9.1, and 149.0.2. CVE-2026-5732 is an integer overflow and incorrect boundary condition in the graphics text component affecting Firefox and Thunderbird. Red Hat has issued updated Thunderbird packages for Red Hat Enterprise Linux 8.8 to address these vulnerabilities.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution, information disclosure, denial of service, and memory safety issues within the Thunderbird mail client and its underlying libraries. These impacts could compromise the confidentiality, integrity, and availability of affected systems running vulnerable versions of Thunderbird on Red Hat Enterprise Linux 8.8. No known exploits in the wild have been reported at this time.

Red Hat has released updated Thunderbird packages (version 140.9.1-1.el8_8) for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are indicated in the vendor advisory.