CVE-2025-48379 is a heap-based buffer overflow vulnerability in the Pillow image processing library used in Red Hat Enterprise Linux AI 1.5 (Intel Gaudi). The flaw occurs when processing a malicious DDS image larger than 64k, due to insufficient size validation when writing image data into an internal buffer. Successful exploitation can lead to local arbitrary code execution with the privileges of the user running the application or cause a denial of service by crashing the application. Red Hat rates this vulnerability as Important and has not released an official fix or effective mitigation yet. The advisory also references CVE-2025-47277 but provides no details or fixes for it. The vulnerability is associated with CWEs 122 (Heap-based Buffer Overflow) and 502 (Deserialization of Untrusted Data).

The vulnerability allows a local attacker to execute arbitrary code or cause a denial of service on systems running Red Hat Enterprise Linux AI 1.5 by exploiting a heap buffer overflow in the Pillow library. This can compromise the integrity and availability of the affected system under the privileges of the user running the vulnerable application. There is no indication of remote exploitation or confidentiality impact. No known exploits are reported in the wild at this time.

Currently, Red Hat has not provided an official fix or mitigation that meets their criteria for this vulnerability. Users should monitor Red Hat advisories for updates. No workaround or mitigation is recommended by Red Hat at this time. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Applying generic mitigations is not advised unless specifically recommended by Red Hat.