RHSA-2026:81128HighCVSS 8.8

Red Hat Security Advisory: Red Hat AI Base Images 3.2.4 (CPU)

Published
October 12, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (12)

CVE-2026-8461 →CVE-2026-11940 →CVE-2026-41142 →CVE-2026-42216 →CVE-2026-58049 →CVE-2026-64834 →CVE-2026-64835 →CVE-2026-15308 →CVE-2026-40962 →CVE-2026-64830 →CVE-2026-66036 →CVE-2026-66039 →

📋 Description

CVE-2026-8461 — ffmpeg: FFmpeg: Remote code execution via out-of-bounds write in MagicYUV decoder CVE-2026-11940 — python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-15308 — python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-40962 — FFmpeg: FFmpeg: Integer overflow and out-of-bounds write via CENC subsample data CVE-2026-41142 — OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing CVE-2026-42216 — OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files CVE-2026-58049 — FFmpeg: FFmpeg: Memory corruption via crafted RASC video stream CVE-2026-64830 — ffmpeg: FFmpeg: Arbitrary code execution via heap buffer overflow in VobSub subtitle demuxer. CVE-2026-64834 — FFmpeg: Denial of Service via crafted RTP/ASF stream CVE-2026-64835 — FFmpeg: FFmpeg: Arbitrary code execution, information disclosure, or denial of service via crafted ADX/AAX audio files CVE-2026-66036 — ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter CVE-2026-66039 — ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

🎯 Affected products5

  • Red Hat OpenShift AI 3.2
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:51548542403b7487481b5677c3ce88e412cb8084f4a77c885bd535e0d674b3f8_ppc64le as a component of Red Hat OpenShift AI 3.2
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:662e63cc2613188c73ba5b1c24a859944cada9687e31802cfeb01a61248dddf1_s390x as a component of Red Hat OpenShift AI 3.2
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:9073242c3b9e1737902542ee3b9a29c2a205b90a00cc7bc88dc926c2eb7ad4c3_arm64 as a component of Red Hat OpenShift AI 3.2
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:c9f5969dddd58d09468fe0f99e1de90e94645dbedd2be1c713755513544d335d_amd64 as a component of Red Hat OpenShift AI 3.2

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:81128 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this vulnerability, users should avoid processing or opening OpenEXR image files from untrusted or unknown sources. Restricting the input of OpenEXR files to only trusted origins can reduce the risk of exploitation. Workaround: To mitigate this issue, avoid processing untrusted or unverified EXR image files. Users should exercise caution when opening EXR files from unknown or suspicious sources, as this vulnerability requires user interaction with a malicious file. Workaround: To mitigate this issue, avoid processing VobSub subtitle files from untrusted or unknown sources. For applications that utilize FFmpeg's VobSub demuxer, consider running them within a sandboxed environment to restrict the potential impact of a successful exploit. Workaround: To mitigate this issue, restrict network access to applications utilizing FFmpeg for RTP/ASF stream demuxing, ensuring only trusted sources can provide such streams. Implement firewall rules to limit inbound connections to the affected services. This may impact legitimate functionality if trusted sources are inadvertently blocked.

🔗 References (16)