The Red Hat AI Inference Server 3.2.2 (ROCm) is affected by multiple security vulnerabilities, including CVE-2026-23868, a double-free vulnerability in the giflib library caused by a shallow copy and improper error handling in GifMakeSavedImage. This flaw can lead to memory corruption, potentially enabling arbitrary code execution or denial of service. Red Hat has identified nine CVEs affecting this product version but has not released patches or fixes as of the advisory date. The vulnerabilities involve various weaknesses such as expired pointer dereference (CWE-825), out-of-bounds read/write (CWE-125, CWE-122), and others. Red Hat's advisory notes that mitigations are either unavailable or insufficient per their criteria, and no known exploits are reported in the wild. The advisory emphasizes that Red Hat remains the authoritative source for impact and remediation status.

Successful exploitation of the identified vulnerabilities could lead to memory corruption, denial of service, or potentially arbitrary code execution on systems running Red Hat AI Inference Server 3.2.2 (ROCm). The double-free vulnerability in giflib is particularly critical as it may allow attackers to manipulate memory, though exploitation is considered difficult. No known active exploits have been reported. The impact affects confidentiality, integrity, and availability of the affected system.

No official patches or fixes are currently available for these vulnerabilities in Red Hat AI Inference Server 3.2.2 (ROCm). Red Hat advises that mitigations are either not available or do not meet their criteria for deployment and stability. Users should monitor Red Hat Product Security advisories for updates and consider applying any recommended mitigations when they become available. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Until fixes are released, cautious deployment and limiting exposure of affected systems are prudent.