Red Hat Product Errata RHSA-2026:8459 - Security Advisory
Issued:
2026-04-16
Updated:
2026-04-16

RHSA-2026:8459 - Security Advisory

Synopsis

Important: thunderbird security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for thunderbird is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

  • libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)
  • libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)
  • thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)
  • thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)
  • firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2451805 - CVE-2026-33416 libpng: libpng: Arbitrary code execution due to use-after-free vulnerability
  • BZ - 2451819 - CVE-2026-33636 libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion
  • BZ - 2455897 - CVE-2026-5734 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
  • BZ - 2455901 - CVE-2026-5731 thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2
  • BZ - 2455908 - CVE-2026-5732 firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component

Red Hat Enterprise Linux for x86_64 9

SRPM
thunderbird-140.9.1-1.el9_7.src.rpm SHA-256: 969d68626bc610f94f246e4dcf64b2e9030fec073f1417302d2d2e7f0a9bfee9
x86_64
thunderbird-140.9.1-1.el9_7.x86_64.rpm SHA-256: 853acc3890c050057558af0d734c78dce11500dc750f1d4559c029c994f010fa
thunderbird-debuginfo-140.9.1-1.el9_7.x86_64.rpm SHA-256: 520273a87f196030a68967300eac8852c78a6b35d6b7998d8930c7e25096b33a
thunderbird-debugsource-140.9.1-1.el9_7.x86_64.rpm SHA-256: 1d04b9cf39a8bb888e9f2b32ca0b4177bde7fc0bbd5f5aa4274b337638fba426

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
thunderbird-140.9.1-1.el9_7.src.rpm SHA-256: 969d68626bc610f94f246e4dcf64b2e9030fec073f1417302d2d2e7f0a9bfee9
s390x
thunderbird-140.9.1-1.el9_7.s390x.rpm SHA-256: 1b5dcdf6a88757dd714e03807f7b8863b49ef4c621b56f06f550f9be65a08f33
thunderbird-debuginfo-140.9.1-1.el9_7.s390x.rpm SHA-256: d87734c3e2cf7f0be2949c84f95c0d685d4ece3eb99b22a59ef11c76284ffb6c
thunderbird-debugsource-140.9.1-1.el9_7.s390x.rpm SHA-256: 45a6f39dcc9b216b251d0e7029b134358ce0e80a60771e88ea6a47542fc6d7dd

Red Hat Enterprise Linux for Power, little endian 9

SRPM
thunderbird-140.9.1-1.el9_7.src.rpm SHA-256: 969d68626bc610f94f246e4dcf64b2e9030fec073f1417302d2d2e7f0a9bfee9
ppc64le
thunderbird-140.9.1-1.el9_7.ppc64le.rpm SHA-256: bfc30f45c3efe2f40602a9025c63f7c59dcdce54b60c03788ddf0bcd51e3b5f0
thunderbird-debuginfo-140.9.1-1.el9_7.ppc64le.rpm SHA-256: f8dddf78b23ebbe936002db2521c9d8dcb769d0fc0e44fff658f0ae634318e8d
thunderbird-debugsource-140.9.1-1.el9_7.ppc64le.rpm SHA-256: 3e9a2b83316661dd85edfacd5d924cd4225635dcc9e3f2bc3d1419d60ef29de0

Red Hat Enterprise Linux for ARM 64 9

SRPM
thunderbird-140.9.1-1.el9_7.src.rpm SHA-256: 969d68626bc610f94f246e4dcf64b2e9030fec073f1417302d2d2e7f0a9bfee9
aarch64
thunderbird-140.9.1-1.el9_7.aarch64.rpm SHA-256: 5259407a6131793c150152e355b1cb4763ad62d2b7780c125ea38c8415095a65
thunderbird-debuginfo-140.9.1-1.el9_7.aarch64.rpm SHA-256: 650fdc739f9279bf7f75ed81ddc98a5c6af1ffc44a113b06ac0a91604da529c8
thunderbird-debugsource-140.9.1-1.el9_7.aarch64.rpm SHA-256: 649f521b4dc1880d70e11baded9030c366212ee1d69f25d20f76369eeb0e9e05

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.