Red Hat Enterprise Linux Ai Rhel Ai 3
Monthly
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from HuggingFace Hub. The linux_train.py script hardcodes trust_remote_code=True, allowing attackers to execute arbitrary Python code by hosting malicious models on HuggingFace and convincing users to run ilab train, download, or generate commands. This configuration weakness enables complete system compromise through social engineering attacks. CVSS 8.8 with network vector but requires user interaction, reducing automatic exploitation risk. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary filesystem locations by manipulating the logs_dir parameter. Red Hat Enterprise Linux AI 3 deployments are confirmed affected. CVSS 7.1 (High) reflects significant confidentiality and integrity impact, though exploitation requires local access and low-level privileges. No active exploitation (CISA KEV) or public proof-of-concept identified at time of analysis. EPSS data not available, suggesting limited immediate widespread exploitation risk despite high severity rating.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
Use-after-free in FFmpeg's RASC video decoder exposes Red Hat Enterprise Linux AI 3 and Red Hat OpenShift AI deployments to denial-of-service attacks via crafted media files. The decode_move() function retains a raw pointer into a heap-allocated decompressed buffer that is subsequently reallocated during move-table processing, leaving the pointer dangling; reading through it crashes the process. No public exploit or KEV listing has been identified at time of analysis, but the network-accessible attack vector (file delivery over the internet) and lack of authentication prerequisites make this a realistic threat to any environment that processes untrusted AVI content using the affected FFmpeg builds.
Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to craft images with specific EXIF orientation or PNG tRNS transparency metadata that, when converted to RGB by vLLM, produces semantically altered image content fed to the LLM - affecting the integrity of inference outputs and potentially the reliability of the inference service. Affected deployments include Red Hat AI Inference Server across RHEL AI 3 and Red Hat OpenShift AI (RHOAI) environments. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, sensitive inference workloads processing user-supplied images (e.g., document classification, content moderation) face a higher practical risk from subtle input distortion attacks.
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).
Denial of service in the Red Hat Quarkus WebSockets Next extension (quarkus-websockets-next), as shipped in Red Hat Build of Quarkus and Red Hat Enterprise Linux AI (RHEL AI) 3, allows a remote, unauthenticated attacker to crash the Java Virtual Machine by streaming WebSocket messages over a single connection faster than the application can consume them. Unbounded message buffering combined with a lack of read backpressure exhausts heap memory, producing a java.lang.OutOfMemoryError that terminates the JVM and takes the hosting service offline; the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms availability-only impact with no confidentiality or integrity loss and requires no authentication, user interaction, or special configuration beyond an attacker-reachable WebSocket endpoint. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was included in the available intelligence; the practical risk is governed by exposure, since only applications serving a WebSocket route to untrusted networks are reachable.
Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from HuggingFace Hub. The linux_train.py script hardcodes trust_remote_code=True, allowing attackers to execute arbitrary Python code by hosting malicious models on HuggingFace and convincing users to run ilab train, download, or generate commands. This configuration weakness enables complete system compromise through social engineering attacks. CVSS 8.8 with network vector but requires user interaction, reducing automatic exploitation risk. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary filesystem locations by manipulating the logs_dir parameter. Red Hat Enterprise Linux AI 3 deployments are confirmed affected. CVSS 7.1 (High) reflects significant confidentiality and integrity impact, though exploitation requires local access and low-level privileges. No active exploitation (CISA KEV) or public proof-of-concept identified at time of analysis. EPSS data not available, suggesting limited immediate widespread exploitation risk despite high severity rating.
Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.
Use-after-free in FFmpeg's RASC video decoder exposes Red Hat Enterprise Linux AI 3 and Red Hat OpenShift AI deployments to denial-of-service attacks via crafted media files. The decode_move() function retains a raw pointer into a heap-allocated decompressed buffer that is subsequently reallocated during move-table processing, leaving the pointer dangling; reading through it crashes the process. No public exploit or KEV listing has been identified at time of analysis, but the network-accessible attack vector (file delivery over the internet) and lack of authentication prerequisites make this a realistic threat to any environment that processes untrusted AVI content using the affected FFmpeg builds.
Image input manipulation in vLLM's multimodal preprocessing pipeline allows remote, unauthenticated network attackers to craft images with specific EXIF orientation or PNG tRNS transparency metadata that, when converted to RGB by vLLM, produces semantically altered image content fed to the LLM - affecting the integrity of inference outputs and potentially the reliability of the inference service. Affected deployments include Red Hat AI Inference Server across RHEL AI 3 and Red Hat OpenShift AI (RHOAI) environments. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, sensitive inference workloads processing user-supplied images (e.g., document classification, content moderation) face a higher practical risk from subtle input distortion attacks.
A remote attacker can trigger a heap out-of-bounds write in FFmpeg's DVD subtitle parser by providing a crafted MPEG-PS/VOB file containing a malicious subtitle stream. This signed integer overflow flaw leads to application crash or potential arbitrary code execution, affecting any software that relies on FFmpeg for media parsing. No public exploit is known, and EPSS indicates a low exploitation probability (0.04%).