The Red Hat AI Inference Server 3.2.2 (CUDA) contains multiple security vulnerabilities, including CVE-2026-23868, a double-free vulnerability in the giflib library caused by a shallow copy and improper error handling in GifMakeSavedImage. This flaw can lead to memory corruption, which may result in arbitrary code execution or denial of service. Red Hat's advisory (RHSA-2026:19724) lists nine CVEs affecting this product version but currently provides no official patches or fixes. The vulnerabilities involve various CWEs such as CWE-824 (Access of Uninitialized Pointer), CWE-125 (Out-of-bounds Read), CWE-88 (Argument Injection or Modification), CWE-190 (Integer Overflow), CWE-122 (Heap-based Buffer Overflow), CWE-825 (Expired Pointer Dereference), CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-617 (Reachable Assertion), and CWE-501 (Trust Boundary Violation). Red Hat has not confirmed any known exploits in the wild and advises customers to consult their Technical Account Managers for further guidance. The lack of an official fix means the patch status is not yet confirmed and users should follow vendor advisories for updates.

The vulnerabilities in Red Hat AI Inference Server 3.2.2 (CUDA) can lead to memory corruption, which may cause denial of service or potentially allow unauthorized code execution. The double-free vulnerability in giflib (CVE-2026-23868) specifically can corrupt memory and is difficult to trigger but may result in high confidentiality, integrity, and availability impacts if exploited. No known active exploitation has been reported. The overall impact is rated high due to the potential for severe consequences if exploited.

Currently, there are no official patches or fixes available for these vulnerabilities in Red Hat AI Inference Server 3.2.2 (CUDA). Red Hat has indicated that available mitigations do not meet their criteria for deployment or stability. Users should monitor Red Hat's security advisories for updates and consider consulting with Red Hat Technical Account Managers for tailored guidance. Until a fix is released, risk mitigation may involve limiting exposure of the affected service and applying any recommended configuration changes from Red Hat once available.