This advisory covers several security fixes for Mozilla Thunderbird and related libraries in Red Hat Enterprise Linux 8.6. The vulnerabilities include a use-after-free arbitrary code execution flaw in libpng (CVE-2026-33416), an out-of-bounds read/write leading to information disclosure and denial of service in libpng's Neon palette expansion (CVE-2026-33636), multiple memory safety bugs in Thunderbird and Firefox ESR versions (CVE-2026-5731, CVE-2026-5734), and an integer overflow due to incorrect boundary conditions in the Graphics: Text component (CVE-2026-5732). These issues affect Thunderbird versions prior to 140.9.1 and have been addressed in updated packages provided by Red Hat.

The vulnerabilities could allow arbitrary code execution, information disclosure, denial of service, and memory safety violations in affected Thunderbird and libpng components. These issues pose a high security risk as they may be exploited to compromise system integrity or confidentiality. However, no known exploits in the wild have been reported at this time.

A security update for Thunderbird is available from Red Hat for Enterprise Linux 8.6. Users should apply the Thunderbird ESR 140.9.1 update or later to remediate these vulnerabilities. Detailed update instructions are provided in the Red Hat advisory RHSA-2026:15889. Since a patch is available, applying the official update is the recommended mitigation.