Red Hat Security Advisory

RHSA-2026:14303

thunderbird security update

Released 2026-05-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v.8.4) thunderbird-140.9.1-1.el8_4
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) thunderbird-140.9.1-1.el8_4

TI-2026-05027 CVE-2026-5734 · GHSA-qf82-86x2-7q23

MEDIUM 43

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00342 Published 2026-04-07 Partial fix · 140.9.1, 149.0.2 CWE-120

TI-2026-05024 CVE-2026-5731 · GHSA-fwrw-mfrr-q8px

MEDIUM 43

Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00353 Published 2026-04-07 Partial fix · 115.34.1, 140.9.1 +1 CWE-119

TI-2026-05025 CVE-2026-5732 · GHSA-mj57-mxq8-qvw9

MEDIUM 40

Incorrect boundary conditions, integer overflow in the Graphics: Text component.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00364 Published 2026-04-07 Partial fix · 140.9.1, 149.0.2 CWE-190

TI-2026-25813 CVE-2026-33416

LOW 37

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01071 Published 2026-03-26 Partial fix · 1.6.56 CWE-416

TI-2026-26017 CVE-2026-33636

LOW 35

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00751 Published 2026-03-26 Partial fix · 1.6.56 CWE-125