Red Hat Product Errata RHSA-2026:14303 - Security Advisory Issued: 2026-05-06 Updated: 2026-05-06 RHSA-2026:14303 - Security Advisory Overview Updated Packages Synopsis Important: thunderbird security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for thunderbird is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734) thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731) firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.4 x86_64 Red Hat Enterprise Linux Server - AUS 8.4 x86_64 Fixes BZ - 2451805 - CVE-2026-33416 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability BZ - 2451819 - CVE-2026-33636 libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion BZ - 2455897 - CVE-2026-5734 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455901 - CVE-2026-5731 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 BZ - 2455908 - CVE-2026-5732 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component CVEs CVE-2026-5731 CVE-2026-5732 CVE-2026-5734 CVE-2026-33416 CVE-2026-33636 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.4 SRPM thunderbird-140.9.1-1.el8_4.src.rpm SHA-256: 60ceaea8805a411aff1d1605b3ef559abb53642024aca8c9f281306ca8d910bd x86_64 thunderbird-140.9.1-1.el8_4.x86_64.rpm SHA-256: 9b2b8af32cb75710ff88585f23ba1596fc2f978475d99b4e7cf4095db2009665 thunderbird-debuginfo-140.9.1-1.el8_4.x86_64.rpm SHA-256: f2842bd3cd2771dbdfb487de384e0c9de846aabc2d64e34a0358d23b6eb41312 thunderbird-debugsource-140.9.1-1.el8_4.x86_64.rpm SHA-256: b39549c6cd72662aaa872b979af4bfb37e91a54ab7959ead004ea4f751f45aaa Red Hat Enterprise Linux Server - AUS 8.4 SRPM thunderbird-140.9.1-1.el8_4.src.rpm SHA-256: 60ceaea8805a411aff1d1605b3ef559abb53642024aca8c9f281306ca8d910bd x86_64 thunderbird-140.9.1-1.el8_4.x86_64.rpm SHA-256: 9b2b8af32cb75710ff88585f23ba1596fc2f978475d99b4e7cf4095db2009665 thunderbird-debuginfo-140.9.1-1.el8_4.x86_64.rpm SHA-256: f2842bd3cd2771dbdfb487de384e0c9de846aabc2d64e34a0358d23b6eb41312 thunderbird-debugsource-140.9.1-1.el8_4.x86_64.rpm SHA-256: b39549c6cd72662aaa872b979af4bfb37e91a54ab7959ead004ea4f751f45aaa The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .