The vulnerability identified in Red Hat Enterprise Linux AI 1.5 (Intel Gaudi) involves the Pillow image processing library, which is used within the platform's container for NVIDIA hardware enablement and the InstructLab application stack. The flaw (CVE-2025-48379) is a heap-based buffer overflow caused by insufficient size checking when writing DDS image data, allowing a local attacker to execute arbitrary code or cause a denial of service by crashing the application. The advisory also references CVE-2025-47277 but provides no details on it. Red Hat has rated this vulnerability as Important (high severity) but currently has no available fix or mitigation that meets their criteria for ease of use, deployment, or stability.

Successful exploitation of the Pillow library vulnerability can lead to local arbitrary code execution with the privileges of the user running the affected application or cause denial of service by crashing the application. This impacts the integrity and availability of the affected system components. No known exploits are reported in the wild. The vulnerability affects the Red Hat Enterprise Linux AI 1.5 container environment, specifically the image processing functionality.

Currently, Red Hat has not provided an official fix or mitigation for this vulnerability that meets their standards for deployment and stability. Users should monitor Red Hat advisories for updates. No alternative mitigations are recommended by Red Hat at this time.