This advisory covers several security fixes in Mozilla Thunderbird and related libraries as packaged for Red Hat Enterprise Linux 10.0 Extended Update Support. The vulnerabilities include CVE-2026-33416 (libpng use-after-free leading to arbitrary code execution), CVE-2026-33636 (libpng out-of-bounds read/write causing information disclosure and denial of service), CVE-2026-5731 and CVE-2026-5734 (memory safety bugs fixed in Firefox ESR and Thunderbird ESR versions 140.9.1 and 149.0.2), and CVE-2026-5732 (integer overflow in the graphics text component). These issues affect Thunderbird versions prior to 140.9.1-1.el10_0 as provided by Red Hat. The advisory references fixes in the Thunderbird 140.9.1 package for multiple architectures and directs users to apply the update to remediate these vulnerabilities.

Successful exploitation of these vulnerabilities could lead to arbitrary code execution, information disclosure, denial of service, or memory safety violations in affected Thunderbird versions. The issues affect core components such as libpng and graphics rendering, which are integral to Thunderbird's operation. The severity is rated as important by Red Hat, indicating a high impact on confidentiality, integrity, or availability if exploited.

Red Hat has released updated Thunderbird packages (version 140.9.1-1.el10_0) for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the provided patches.