RHSA-2026:81161HighCVSS 8.8

Red Hat Security Advisory: Red Hat AI Base Images 3.5.3 (CPU)

Published
October 12, 2026
Last Modified
October 13, 2026

🔗 CVE IDs covered (5)

CVE-2026-66039 →CVE-2026-11940 →CVE-2026-15308 →CVE-2026-64834 →CVE-2026-66036 →

📋 Description

CVE-2026-11940 — python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-15308 — python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations CVE-2026-64834 — FFmpeg: Denial of Service via crafted RTP/ASF stream CVE-2026-66036 — ffmpeg: FFmpeg: Arbitrary code execution via crafted video in vf_hqdn3d filter CVE-2026-66039 — ffmpeg: FFmpeg: Arbitrary code execution via crafted CAF file

🎯 Affected products5

  • Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:13a29a7bed2ed4f3fd993115ea17d5a4da7a77fc54a00213f640914625dcca82_arm64 as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:5162c1225a7ff4f6b528e231a98710aa0b340282e637ffdc461fedd2f8e6c5eb_s390x as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:90ea3f7558ba5ed2e75964443249c0e4fd3b467722f51ff43f72669728fb9e74_ppc64le as a component of Red Hat OpenShift AI 3.5
  • registry.redhat.io/rhai/base-image-cpu-rhel9@sha256:ad3701b34775e7be1057b2a52a88d13011e61560012c78bd4f44c815a9cc4f35_amd64 as a component of Red Hat OpenShift AI 3.5

✅ Remediation

For more information visit https://access.redhat.com/errata/RHSA-2026:81161 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, restrict network access to applications utilizing FFmpeg for RTP/ASF stream demuxing, ensuring only trusted sources can provide such streams. Implement firewall rules to limit inbound connections to the affected services. This may impact legitimate functionality if trusted sources are inadvertently blocked.

🔗 References (9)