Red Hat Product Errata RHSA-2026:9638 - Security Advisory Issued: 2026-04-22 Updated: 2026-04-22 RHSA-2026:9638 - Security Advisory Overview Updated Packages Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for thunderbird is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Fixes BZ - 2451805 - CVE-2026-33416 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability BZ - 2451819 - CVE-2026-33636 libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion BZ - 2455897 - CVE-2026-5734 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455901 - CVE-2026-5731 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455908 - CVE-2026-5732 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component CVEs CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM thunderbird-140.9.1-1.el10_1.src.rpm SHA-256: 7d75a3ab316012fa49bce467616397c10e1e6c938596633ca62e15c1affc672d x86_64 thunderbird-140.9.1-1.el10_1.x86_64.rpm SHA-256: 1a75789a137eb4d0ee429d6622c40b1533b33aa48a1c6af3245785842263c59b thunderbird-debuginfo-140.9.1-1.el10_1.x86_64.rpm SHA-256: 20800276a36a01374706b793cd60ce03637db24a7a2b4e3ba22266515c488b04 thunderbird-debugsource-140.9.1-1.el10_1.x86_64.rpm SHA-256: ec6527f0e7272974eb66f26f343834820c1e5bad39088f9f4dceab8010a9f91c Red Hat Enterprise Linux for IBM z Systems 10 SRPM thunderbird-140.9.1-1.el10_1.src.rpm SHA-256: 7d75a3ab316012fa49bce467616397c10e1e6c938596633ca62e15c1affc672d s390x thunderbird-140.9.1-1.el10_1.s390x.rpm SHA-256: 958fb60eb18ccde53ddff8e9b5f8d298ea8ddf87a52f63fefa3327b4ef02bceb thunderbird-debuginfo-140.9.1-1.el10_1.s390x.rpm SHA-256: 537d798fa2e6ae940f181a98ff06639e22ea44195df33dc2816138269d0d0bb2 thunderbird-debugsource-140.9.1-1.el10_1.s390x.rpm SHA-256: 41d5b38dec192b61451fac6066be7155539fc3bd032afe804c8ffa022ccf9347 Red Hat Enterprise Linux for Power, little endian 10 SRPM thunderbird-140.9.1-1.el10_1.src.rpm SHA-256: 7d75a3ab316012fa49bce467616397c10e1e6c938596633ca62e15c1affc672d ppc64le thunderbird-140.9.1-1.el10_1.ppc64le.rpm SHA-256: 9a5a8348fb024648be13c041336b40890df629b142b9db6fa2931340ae9a799a thunderbird-debuginfo-140.9.1-1.el10_1.ppc64le.rpm SHA-256: dfa84024e92b49151da969f66ba88d9515b84d1fd95de1b5bb8c3408bf9bf6a9 thunderbird-debugsource-140.9.1-1.el10_1.ppc64le.rpm SHA-256: 10d7271d0b3a585663c19e124dc35cabbd65a5930a33498f0864c9ae1a184d89 Red Hat Enterprise Linux for ARM 64 10 SRPM thunderbird-140.9.1-1.el10_1.src.rpm SHA-256: 7d75a3ab316012fa49bce467616397c10e1e6c938596633ca62e15c1affc672d aarch64 thunderbird-140.9.1-1.el10_1.aarch64.rpm SHA-256: 6baa2f6a7fc1d704cf2ea7f91f5baea9ab8c25d5c6cc67e2c10e80a0e0045259 thunderbird-debuginfo-140.9.1-1.el10_1.aarch64.rpm SHA-256: 5d73904bca009e487a0bffb705449a3f99663ecd81ae60b719d040533f0fab35 thunderbird-debugsource-140.9.1-1.el10_1.aarch64.rpm SHA-256: 6434dc46b5324ba005a9e07bd3145aa9f49caadda9ce962343444de2d0c35cde The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .