Skip to main content
CVE-2026-8461VulnerabilityPublished Updated

Red Hat Security Advisory: Red Hat AI Base Images 3.2.5 (ROCm 7.0)

Affects Red HatSource GCVE Database

0
Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 29 Oct 2026, 07:56 UTC

Severity
High

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS
1.5% chance of exploitation in 30 days – higher than 75% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 14 Oct 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: evidence found.

    Public exploit code: GitHub proofs of concept

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

What to do

AI-suggested

No official patches or fixes are currently available for the vulnerabilities in Red Hat AI Base Images 3.2.5 (ROCm 7.0). Red Hat is actively pursuing fixes through their product streams. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and apply fixes once released. Since exploitation requires local processing of crafted media files, limiting exposure to untrusted media files may reduce risk.

Description

A security advisory from Red Hat addresses multiple vulnerabilities affecting Red Hat AI Base Images 3.2.5 (ROCm 7.0), including CVE-2026-8461 and others. One notable flaw is an integer overflow in FFmpeg's processing of Common Encryption (CENC) subsample data, which can lead to out-of-bounds writes. This flaw could allow a local attacker, through processing a specially crafted media file, to cause information disclosure, data corruption, or denial of service. Red Hat rates this FFmpeg vulnerability as moderate impact, differing from other sources due to the local attack vector and required user interaction. No fixes are currently available for these issues in the affected Red Hat AI Base Images. Red Hat is pursuing fixes through product streams, but mitigation options are limited or unavailable at this time.

References

Community reviews

Loading reviews…