RHSA-2026:69468HighCVSS 9.1

Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.5 (cuda)

Published
September 21, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (10)

CVE-2026-55379 →CVE-2026-55380 →CVE-2026-59197 →CVE-2026-59204 →CVE-2026-5241 →CVE-2026-54058 →CVE-2026-54060 →CVE-2026-59199 →CVE-2026-59200 →CVE-2026-59205 →

📋 Description

CVE-2026-5241 — python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API

🎯 Affected products3

  • Red Hat AI Inference Server 3.4
  • registry.redhat.io/rhaii/model-opt-cuda-rhel9@sha256:4a4d625a573c40d2a70d03b28e15f1de9b377782e05d5108298dc09571ef25f4_amd64 as a component of Red Hat AI Inference Server 3.4
  • registry.redhat.io/rhaii/model-opt-cuda-rhel9@sha256:58b52521658f0e40239985f3ec25a3a131150101112395b54838a86c0cdd97b1_arm64 as a component of Red Hat AI Inference Server 3.4

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:69468 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.

🔗 References (14)