Red Hat Product Errata RHSA-2026:9345 - Security Advisory Issued: 2026-04-21 Updated: 2026-04-21 RHSA-2026:9345 - Security Advisory Overview Updated Packages Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2451805 - CVE-2026-33416 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability BZ - 2451819 - CVE-2026-33636 libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion BZ - 2455897 - CVE-2026-5734 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455901 - CVE-2026-5731 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455908 - CVE-2026-5732 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component CVEs CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a x86_64 thunderbird-140.9.1-1.el8_10.x86_64.rpm SHA-256: 2989d52d9250270b7e3b54d2bfc9e04272dd801b3ed9da6996080784ebd2f187 thunderbird-debuginfo-140.9.1-1.el8_10.x86_64.rpm SHA-256: f255f53392f84fe377c509bf96fd66b42b4481c624c5b86d70f55c4303789894 thunderbird-debugsource-140.9.1-1.el8_10.x86_64.rpm SHA-256: 7f44a94dc12fb9dd2802eb31edf02e5600f9e0b72d582dcfecb12c4a55959031 Red Hat Enterprise Linux for IBM z Systems 8 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a s390x thunderbird-140.9.1-1.el8_10.s390x.rpm SHA-256: 5516b826d4820a072452b4c5d4236417dc7b3703ff597c6cf1412b883abbc2fc thunderbird-debuginfo-140.9.1-1.el8_10.s390x.rpm SHA-256: 5c0c8537bec2d7cba4850d98741017c3e28d60e4d793cc96ccbae5e48a7225e0 thunderbird-debugsource-140.9.1-1.el8_10.s390x.rpm SHA-256: b87e2ca3e76cd65be0dfafa7650254a6543ab9af65d5b872a2ab2234b2cdb8c8 Red Hat Enterprise Linux for Power, little endian 8 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a ppc64le thunderbird-140.9.1-1.el8_10.ppc64le.rpm SHA-256: cfbf4a5571f3507d8b6060e443c973655a7dd1f8508bc75b5a412867f5130f0f thunderbird-debuginfo-140.9.1-1.el8_10.ppc64le.rpm SHA-256: 3cc1a103adcec9a3e2be25685b2be45934c149c75f5b57cbac3e1cc40458d639 thunderbird-debugsource-140.9.1-1.el8_10.ppc64le.rpm SHA-256: 2df18d84252f5b6da7f14c599c4954828eb7ada9ad82abaf2f28e6d487f6c1e9 Red Hat Enterprise Linux for ARM 64 8 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a aarch64 thunderbird-140.9.1-1.el8_10.aarch64.rpm SHA-256: 1201f3d9995b70a1b949ab20189d799d7216677fde8dd80709ea99463b5209a8 thunderbird-debuginfo-140.9.1-1.el8_10.aarch64.rpm SHA-256: 184ac132901b1428126d42d4e80347ca7fb101d87af9c9b999041435730f011b thunderbird-debugsource-140.9.1-1.el8_10.aarch64.rpm SHA-256: 3c6df1500d8cdba6ef0584fce702a20065098bd0e50b6db4e5bc5222c0a373a2 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a x86_64 thunderbird-140.9.1-1.el8_10.x86_64.rpm SHA-256: 2989d52d9250270b7e3b54d2bfc9e04272dd801b3ed9da6996080784ebd2f187 thunderbird-debuginfo-140.9.1-1.el8_10.x86_64.rpm SHA-256: f255f53392f84fe377c509bf96fd66b42b4481c624c5b86d70f55c4303789894 thunderbird-debugsource-140.9.1-1.el8_10.x86_64.rpm SHA-256: 7f44a94dc12fb9dd2802eb31edf02e5600f9e0b72d582dcfecb12c4a55959031 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a aarch64 thunderbird-140.9.1-1.el8_10.aarch64.rpm SHA-256: 1201f3d9995b70a1b949ab20189d799d7216677fde8dd80709ea99463b5209a8 thunderbird-debuginfo-140.9.1-1.el8_10.aarch64.rpm SHA-256: 184ac132901b1428126d42d4e80347ca7fb101d87af9c9b999041435730f011b thunderbird-debugsource-140.9.1-1.el8_10.aarch64.rpm SHA-256: 3c6df1500d8cdba6ef0584fce702a20065098bd0e50b6db4e5bc5222c0a373a2 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a ppc64le thunderbird-140.9.1-1.el8_10.ppc64le.rpm SHA-256: cfbf4a5571f3507d8b6060e443c973655a7dd1f8508bc75b5a412867f5130f0f thunderbird-debuginfo-140.9.1-1.el8_10.ppc64le.rpm SHA-256: 3cc1a103adcec9a3e2be25685b2be45934c149c75f5b57cbac3e1cc40458d639 thunderbird-debugsource-140.9.1-1.el8_10.ppc64le.rpm SHA-256: 2df18d84252f5b6da7f14c599c4954828eb7ada9ad82abaf2f28e6d487f6c1e9 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 SRPM thunderbird-140.9.1-1.el8_10.src.rpm SHA-256: 87cf85f33494a7937245e9968a85730a3c9aeffd8923896b6e804b64e6febd6a s390x thunderbird-140.9.1-1.el8_10.s390x.rpm SHA-256: 5516b826d4820a072452b4c5d4236417dc7b3703ff597c6cf1412b883abbc2fc thunderbird-debuginfo-140.9.1-1.el8_10.s390x.rpm SHA-256: 5c0c8537bec2d7cba4850d98741017c3e28d60e4d793cc96ccbae5e48a7225e0 thunderbird-debugsource-140.9.1-1.el8_10.s390x.rpm SHA-256: b87e2ca3e76cd65be0dfafa7650254a6543ab9af65d5b872a2ab2234b2cdb8c8 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .