CVE-2026-21863 is a high-severity vulnerability affecting Red Hat Hardened Images RPM packages, specifically valkey components for aarch64 and x86_64 architectures. The vulnerability is classified as CWE-125, indicating an out-of-bounds read condition. Red Hat has issued an advisory (RHSA-2026:8753) detailing updated RPM versions (valkey-9.0.3-1.2.hum1 and related packages) as part of a bug fix and enhancement update. The advisory content does not explicitly state whether these updates fully remediate the vulnerability, nor does it provide direct patch links. There are no known exploits reported in the wild at this time.

The vulnerability has a CVSS vector indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. This suggests the flaw could be exploited remotely to cause denial of service or system instability without compromising confidentiality or integrity. No active exploitation has been reported.

Red Hat has released updated RPM packages for valkey components as part of this advisory. While explicit patch availability is not confirmed in the advisory text, the presence of updated package versions strongly indicates that a fix is available. Users of affected Red Hat Hardened Images and valkey packages should apply the updates to mitigate the vulnerability. Monitor Red Hat's official advisory page for confirmation and further remediation instructions.