Red Hat Security Advisory

RHSA-2026:82066

Red Hat AI Inference Model Optimization Tools 3.5.2 (CUDA)

Released 2026-10-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat AI Inference Server 3.5 registry.redhat.io/rhaii/model-opt-cuda-rhel9

Fixes 34 records

TI-2026-41775 CVE-2026-58014 · GHSA-h88q-m8mm-7243

Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"

HIGH 76

A flaw was found in GLib.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00558 Published 2026-06-30 Partial fix · 2.88.1, 2.80.4-12.el10_2.21 +94 CWE-193

TI-2026-41772 CVE-2026-58011 · GHSA-8xmh-8wfg-9f6j

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

HIGH 72

A flaw was found in GLib.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00474 Published 2026-06-30 Partial fix · 2.86.5, 2.88.1 +87 CWE-125

TI-2026-13488 CVE-2026-16118 · GHSA-cp7g-r78m-cc2g

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

MEDIUM 64

A flaw was found in xdgmime.

CVSS 3.1HIGH 7.1 Local No auth User interaction EPSS 0.00277 Published 2026-07-17 Partial fix · 2.80.4-12.el10_2.22, 2.80.4-4.el10_0.18 +79 CWE-122

TI-2026-13117 CVE-2026-15588 · GHSA-hrq7-vgh7-p534

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

MEDIUM 57

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib.

CVSS 3.1MEDIUM 5.3 Local Low privileges No interaction EPSS 0.00579 Published 2026-07-20 Partial fix · 2.80.4-12.el10_2.21, 2.80.4-4.el10_0.17 +87 CWE-770

TI-2026-46359 CVE-2026-64834 · GHSA-5xcx-3qx2-qv4x

FFmpeg 0.6.3 - 8.1.2 Infinite Loop DoS via RTP/ASF Demuxer

MEDIUM 45

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdec_asf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF strea…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00727 Published 2026-07-22 Fixed CWE-835

TI-2026-42784 CVE-2026-60002 · GHSA-gp5v-jg37-fvg6

Use after free in OpenBSD OpenSSH

MEDIUM 42

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.003 Published 2026-07-08 Partial fix · 10.4 CWE-416

TI-2026-41773 CVE-2026-58012 · GHSA-vwg8-37h9-g38g

Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()

MEDIUM 42

A flaw was found in GLib.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00491 Published 2026-06-30 Partial fix · 2.86.5, 2.88.1 +87 CWE-126

TI-2026-41771 CVE-2026-58010 · GHSA-m7rp-473c-296x

Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()

MEDIUM 42

A flaw was found in GLib.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00491 Published 2026-06-30 Partial fix · 2.86.5, 2.88.1 +87 CWE-126

TI-2026-46355 CVE-2026-64830 · GHSA-jphx-q7f7-4x8r

FFmpeg 2.1 - 8.1.2 Heap Buffer Overflow via VobSub Subtitle Demuxer

MEDIUM 41

FFmpeg versions 2.1 through 8.1.2 contains a heap buffer overflow vulnerability in the VobSub subtitle demuxer that allows attackers to corrupt adjacent heap memory by supplying a malicious .sub/.idx subtitle file declar…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00646 Published 2026-07-22 Partial fix CWE-122

TI-2026-10297 CVE-2026-11940 · GHSA-9mc4-rqmq-h467

tarfile extraction filter bypass allows escaping the destination directory

MEDIUM 41

tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself.

CVSS 4.0HIGH 7.8 Network No auth No interaction EPSS 0.0075 Published 2026-06-23 Partial fix · 3.10.21, 3.11.16 +4 CWE-22

TI-2026-32373 CVE-2026-44432 · GHSA-mf9v-mfxr-j63j

urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API

MEDIUM 40

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.0068 Published 2026-05-13 Partial fix · 2.7.0 CWE-409

TI-2026-51285 CVE-2026-73078

Vim: Arbitrary Code Execution via Netrw Menu Construction

LOW 39

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00314 Published 2026-08-11 Partial fix · 9.2.0840 CWE-184

TI-2026-47028 CVE-2026-66039 · GHSA-84qc-6h9r-4w33

FFmpeg MACE6 Audio Decoder Heap Out-of-Bounds Write via CAF File

LOW 39

FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious byt…

CVSS 4.0HIGH 8.7 Network No auth User interaction EPSS 0.00307 Published 2026-07-24 Fixed CWE-122

TI-2026-51279 CVE-2026-73072

Vim: Heap Buffer Overflow when Loading a Spell File

LOW 38

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00115 Published 2026-08-11 Partial fix · 9.2.0846 CWE-122

TI-2026-42671 CVE-2026-59856

Vim: Arbitrary Code Execution via PHP Omni-Completion

LOW 38

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00216 Published 2026-07-09 Partial fix · 9.2.0736 CWE-94

TI-2026-10207 CVE-2026-11824 · GHSA-8g48-4wfm-7247

SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate

LOW 38

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00182 Published 2026-06-09 Partial fix · 3.53.2 CWE-122

TI-2026-51284 CVE-2026-73077

Vim: Arbitrary Code Execution via Shell Keyword Lookup

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00144 Published 2026-08-11 Fixed in 9.2.0839 CWE-78

TI-2026-51283 CVE-2026-73076

Vim: Arbitrary Command Execution via Malicious `.VimballRecord` Entry Replay in `vimball.vim`

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00134 Published 2026-08-11 Partial fix · 9.2.0847 CWE-829

TI-2026-42673 CVE-2026-59858

Vim: Arbitrary Code Execution via C Omni-Completion

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00137 Published 2026-07-09 Partial fix · 9.2.0735 CWE-94

TI-2026-41774 CVE-2026-58013 · GHSA-4x46-h598-64qr

Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"

LOW 37

A flaw was found in GLib.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0071 Published 2026-06-30 Partial fix · 2.88.1, 2.80.4-12.el10_2.21 +86 CWE-126

TI-2026-41388 CVE-2026-57456

Vim: Arbitrary Code Execution via Python Omni-Completion Docstrings

LOW 37

Vim is an open source, command line text editor.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00145 Published 2026-06-25 Fixed in 9.2.0699 CWE-94

TI-2026-39261 CVE-2026-54369 · GHSA-53ch-pxc8-6g72

acl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions

LOW 37

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to esc…

CVSS 4.0HIGH 8.4 Local Low privileges No interaction EPSS 0.00153 Published 2026-06-29 Partial fix · 2.4.0 CWE-59

TI-2026-47025 CVE-2026-66036 · GHSA-575m-jfmw-q76c

FFmpeg Heap Out-of-Bounds Write in vf_hqdn3d Filter

LOW 36

FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution in…

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00401 Published 2026-07-24 Fixed CWE-122

TI-2026-32372 CVE-2026-44431 · GHSA-qccp-gfcp-xxvc

urllib3: Sensitive headers forwarded across origins in proxied low-level redirects

LOW 36

urllib3 is an HTTP client library for Python.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00331 Published 2026-05-13 Partial fix · 2.7.0 CWE-200

TI-2026-41776 CVE-2026-58015 · GHSA-hmpf-72wc-2r6x

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

LOW 34

A flaw was found in GLib.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0084 Published 2026-06-30 Partial fix · 2.88.1, 2.80.4-12.el10_2.21 +91 CWE-22

TI-2026-34752 CVE-2026-47162

Vim: Vimscript Code Injection in netrw NetrwBookHistSave() via crafted directory name

LOW 34

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00275 Published 2026-06-11 Partial fix · 9.2.0495 CWE-74

TI-2026-37963 CVE-2026-52858

Vim: Arbitrary Code Execution via Python Omni-Completion

LOW 33

Vim is an open source, command line text editor.

CVSS 4.0HIGH 7.3 Network Low privileges User interaction EPSS 0.00201 Published 2026-06-11 Partial fix · 9.2.0561 CWE-829

TI-2026-10205 CVE-2026-11822 · GHSA-6qj8-gw6p-hc5p

SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek

LOW 31

SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00195 Published 2026-06-09 Partial fix · 3.53.2 CWE-125

TI-2026-39287 CVE-2026-54411 · GHSA-56gg-22rq-q53x

Linux-PAM pam_userdb Observable Timing Discrepancy in Plaintext Password Comparison

LOW 30

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacke…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0032 Published 2026-06-14 Partial fix CWE-208

TI-2026-51273 CVE-2026-73066

Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata

LOW 29

Tesseract is an open source OCR engine.

CVSS 4.0MEDIUM 6.8 Local No auth User interaction EPSS 0.00126 Published 2026-08-11 Fixed in 5.5.3 CWE-787

TI-2026-40208 CVE-2026-55693

Vim: Out-of-bounds Write in Spell File Word Count

LOW 26

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 5.7 Local No auth User interaction EPSS 0.00124 Published 2026-06-25 Partial fix · 9.2.0653 CWE-787

TI-2026-34757 CVE-2026-47167

Vim: Vimscript Code Injection in cucumber filetype plugin via crafted step-definition regex

LOW 24

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00135 Published 2026-06-11 Partial fix · 9.2.0496 CWE-94

TI-2026-41387 CVE-2026-57455

Vim: Stack out-of-bounds write in `spell_soundfold_sofo()` via an over-length `soundfold()` argument

LOW 20

Vim is an open source, command line text editor.

CVSS 4.0MEDIUM 4.0 Local No auth User interaction EPSS 0.00118 Published 2026-06-25 Partial fix · 9.2.0698 CWE-787

TI-2025-05580 CVE-2025-6170 · GHSA-6qrf-r65h-2r77

Libxml2: stack buffer overflow in xmllint interactive shell command handling

LOW 13

A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files.

CVSS 3.1LOW 2.5 Local No auth User interaction EPSS 0.00323 Published 2025-06-16 Partial fix · 2.14.5, 2.12.5-10.el10_2.2 +89 CWE-121