Skip to main content
CVE-2026-8461VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat AI Base Images 3.2.5 (CUDA 12.9)

Affects Red HatSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 29 Oct 2026, 07:56 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS
1.5% chance of exploitation in 30 days – higher than 75% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 14 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: evidence found.

    Public exploit code: GitHub proofs of concept

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

AI-suggested

Currently, no effective mitigations meeting Red Hat's criteria for ease of use, applicability, and stability are available for these vulnerabilities. Red Hat is pursuing fixes through product streams. Users should monitor Red Hat advisories for updates and apply patches once they become available. Until then, avoid processing untrusted media files with affected FFmpeg components to reduce risk.

Description

A security advisory from Red Hat addresses multiple vulnerabilities affecting Red Hat AI Base Images 3.2.5 (CUDA 12.9), including CVE-2026-8461 and others. One notable flaw (CVE-2026-40962) involves an integer overflow and out-of-bounds write in FFmpeg's processing of Common Encryption (CENC) subsample data, which could allow local attackers to cause information disclosure, data corruption, or denial of service by processing specially crafted media files. Red Hat rates this flaw as moderate impact due to the local attack vector and required user interaction. No fixes are currently available for these vulnerabilities in the affected AI base images. Red Hat is pursuing fixes through product streams, but mitigation options are limited or not meeting their criteria for deployment.

References

Community reviews

Loading reviews…