The Red Hat AI Inference Server 3.3.3 (CUDA) is impacted by a set of vulnerabilities including a double-free flaw in giflib (CVE-2026-23868) caused by shallow copying and improper error handling, which can corrupt memory. This vulnerability could potentially allow an attacker to execute arbitrary code or cause a denial of service, although exploitation is difficult. The advisory lists a total of 12 CVEs affecting this product version. Red Hat has published an advisory (RHSA-2026:16030) but no patches or fixes are currently available. The affected version is explicitly 3.3.3. The vulnerabilities include various CWEs such as CWE-824 (Access of Uninitialized Pointer), CWE-125 (Out-of-bounds Read), CWE-88 (Argument Injection or Modification), CWE-190 (Integer Overflow), CWE-122 (Heap-based Buffer Overflow), among others. Red Hat notes that mitigation options are either unavailable or do not meet their criteria for deployment and stability. No active exploitation has been reported.

Successful exploitation of the giflib double-free vulnerability and other listed flaws could lead to memory corruption, potentially resulting in arbitrary code execution or denial of service conditions. The impact includes high confidentiality, integrity, and availability risks as per Red Hat's assessment for CVE-2026-23868. The vulnerabilities affect the stability and security of the Red Hat AI Inference Server 3.3.3 (CUDA) environment. No known exploits in the wild have been reported so far.

Red Hat has not released patches or fixes for these vulnerabilities as of the advisory date. Mitigation options are either unavailable or do not meet Red Hat's criteria for ease of use, deployment, or stability. Users are advised to monitor Red Hat's official advisories for updates. Customers with a Technical Account Manager (TAM) or Red Hat Security Select Add-on can consult directly with Red Hat for guidance. Until fixes are available, consider risk assessment and potential temporary mitigations specific to your deployment environment.