RHSA-2026:70996HighCVSS 9.1

Red Hat Security Advisory: Red Hat AI Inference Model Optimization Tools 3.4.5 (cuda)

Published
September 23, 2026
Last Modified
October 2, 2026

🔗 CVE IDs covered (11)

CVE-2026-5241 →CVE-2026-54058 →CVE-2026-55379 →CVE-2026-59199 →CVE-2026-64847 →CVE-2026-54060 →CVE-2026-55380 →CVE-2026-59197 →CVE-2026-59200 →CVE-2026-59204 →CVE-2026-59205 →

📋 Description

CVE-2026-5241 — python-transformers: python-transformers: Arbitrary code execution due to overridden trust_remote_code setting CVE-2026-54058 — Pillow: Pillow: Memory disclosure or denial of service via crafted McIdas AREA image CVE-2026-54060 — python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files CVE-2026-55379 — python-pillow: Pillow: Denial of Service via crafted BDF font file CVE-2026-55380 — python-pillow: Pillow: Denial of Service via crafted GD 2.x image file CVE-2026-59197 — Pillow: Pillow: Native heap out-of-bounds write CVE-2026-59199 — Pillow: Pillow: Denial of Service via out-of-bounds write in image processing CVE-2026-59200 — Pillow: Pillow: Denial of service via crafted PDF stream CVE-2026-59204 — Pillow: Pillow: Denial of Service via crafted JPEG2000 image CVE-2026-59205 — Pillow: Pillow: Controlled native heap corruption in ImageCms.ImageCmsTransform.apply API CVE-2026-64847 — anyio: AnyIO: Denial of Service due to undrained stderr in process-pool workers

🎯 Affected products3

  • Red Hat AI Inference Server 3.4
  • registry.redhat.io/rhaii/model-opt-cuda-rhel9@sha256:17ad8c121c110188be68fde0bca2b6fa27f36f3855cb9badd815ef5e5ddf67f9_arm64 as a component of Red Hat AI Inference Server 3.4
  • registry.redhat.io/rhaii/model-opt-cuda-rhel9@sha256:cea1593ceb68ea72897f544628f83ac92f9c9ab44f16b89aad065971c50fd427_amd64 as a component of Red Hat AI Inference Server 3.4

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:70996 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Do not load BDF font files from untrusted sources. Applications that only process standard image formats (PNG, JPEG, etc.) and do not use BdfFontFile or ImageFont.load() with BDF files are not affected. Workaround: Avoid processing untrusted GD 2.x image files with PIL.GdImageFile.open(). Use Image.open() instead, which includes decompression bomb protections for supported formats. If GdImageFile must be used, validate the image dimensions before calling load(). Restricting accepted image formats at the application boundary to only those explicitly needed can reduce exposure. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: If the application does not need JPEG2000 support, block .jp2, .j2k, .jpf, and .jpx uploads at the input layer. For services that do process JPEG2000, set memory limits on the process or container (LimitAS= in systemd, or memory limits in Kubernetes/Podman) so a crafted image can only crash the worker, not the whole host. Add automatic restarts (Restart=always in systemd, or container restart policies) so the service recovers from OOM kills without someone having to intervene. Workaround: Most applications using Pillow's color management via profileToProfile() or applyTransform() are not exposed. Only code that calls ImageCmsTransform.apply() directly with a user-controlled output image whose mode does not match the transform can trigger the heap corruption. Audit your code for direct apply() calls to confirm. RHEL builds ship with ASLR, full RELRO/PIE, and FORTIFY_SOURCE by default, making escalation from crash to code execution much harder. For DoS containment, configure automatic service restart (Restart=always in systemd, or container restart policies) so the process recovers without manual intervention.

🔗 References (15)