This advisory covers several security fixes for Mozilla Thunderbird and related libraries in Red Hat Enterprise Linux 8.6. The vulnerabilities include CVE-2026-33416, a use-after-free in libpng leading to arbitrary code execution; CVE-2026-33636, an out-of-bounds read/write in libpng causing information disclosure and denial of service; CVE-2026-5731 and CVE-2026-5734, memory safety bugs fixed in Thunderbird ESR 140.9.1 and 149.0.2 as well as Firefox ESR 115.34.1, 140.9.1, and 149.0.2; and CVE-2026-5732, an integer overflow in the graphics text component affecting Firefox and Thunderbird. These issues are addressed by updated Thunderbird packages provided by Red Hat for various 8.6 variants including AUS, E4S, and TUS. The advisory references Red Hat Bugzilla entries and provides updated package versions for remediation.

Successful exploitation of these vulnerabilities could allow arbitrary code execution, information disclosure, denial of service, or memory corruption in affected Thunderbird installations. The use-after-free and memory safety bugs pose a risk of remote code execution or application crashes. The integer overflow and out-of-bounds read/write could lead to denial of service or data leakage. These issues affect Thunderbird clients on Red Hat Enterprise Linux 8.6 variants, potentially impacting confidentiality, integrity, and availability of mail client operations.

Red Hat has released updated Thunderbird packages (version 140.9.1-1.el8_6) for Red Hat Enterprise Linux 8.6 variants including AUS, E4S, and TUS. Applying these official updates will remediate the described vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the security update promptly. No additional mitigation is indicated by the vendor advisory.