CVE-2026-64835 and CVE-2026-58049 are vulnerabilities in FFmpeg used within Red Hat Enterprise Linux AI. CVE-2026-64835 can lead to arbitrary code execution, information disclosure, or denial of service triggered by specially crafted ADX/AAX audio files. CVE-2026-58049 causes memory corruption when processing crafted RASC video streams. Red Hat has issued security advisories (RHSA-2026:51180 and RHSA-2026:43711) that backport upstream fixes into the ffmpeg-6.1.6-3.el9ai package. These fixes address the vulnerabilities in multiple architectures (x86_64, s390x, ppc64le, aarch64) and versions of Red Hat Enterprise Linux AI (3.0, 3.2, 3.3, 3.5). The vendor advisory explicitly states that updated packages are available and should be applied to remediate these issues. No active exploitation has been reported.

Successful exploitation of CVE-2026-64835 could allow an attacker to execute arbitrary code, disclose sensitive information, or cause denial of service on affected systems via crafted audio files. CVE-2026-58049 could lead to memory corruption, potentially resulting in application crashes or arbitrary code execution when processing malicious video streams. These vulnerabilities affect the FFmpeg multimedia framework component within Red Hat Enterprise Linux AI. The severity is high, indicating significant risk if unpatched.

Red Hat has released updated ffmpeg packages (version 6.1.6-3.el9ai) that backport fixes for CVE-2026-64835 and CVE-2026-58049. Users of Red Hat Enterprise Linux AI versions 3.0, 3.2, 3.3, and 3.5 should apply these updates promptly. The vendor advisory provides detailed package names and SHA-256 checksums for verification. No additional mitigation steps are indicated or required beyond applying the official patches.