This Red Hat security advisory (RHSA-2026:9228) updates multiple python3.14 RPM packages within Red Hat Hardened Images to address several vulnerabilities identified by CVE-2025-15366, CVE-2025-15367, CVE-2026-0865, and CVE-2026-1299. The advisory lists affected RPMs including python3, python3-debug, python3-devel, python3-libs, and others for aarch64 and x86_64 architectures. The vulnerabilities involve weaknesses classified under CWEs such as CWE-77 (Improper Neutralization of Special Elements used in a Command), CWE-93 (Improper Neutralization of CRLF Sequences), CWE-88 (Argument Injection or Modification), CWE-822 (Untrusted Pointer Dereference), and CWE-825 (Expansion of Privilege). The advisory does not specify fixed versions or detailed patch instructions but references the Red Hat Hardened Images update site for applying the update. No CVSS score is provided, and no known exploits in the wild have been reported.

The vulnerabilities addressed involve potential command injection, improper input neutralization, and privilege escalation risks within the python3.14 RPM packages in Red Hat Hardened Images. These could allow an attacker to execute arbitrary commands or escalate privileges if exploited. However, no known active exploits have been reported, and the advisory implies that updating the RPMs mitigates these issues.

Red Hat has released updated RPM packages for python3.14 as part of the Red Hat Hardened Images update. Users should apply these updates by following the instructions at https://images.redhat.com/. Since this is an official Red Hat security advisory, applying the provided updates is the recommended remediation. Patch status is not explicitly confirmed in the advisory text, so users should verify the update availability and instructions on the official Red Hat advisory page. No additional mitigation steps are specified or required beyond applying the update.