This advisory covers two vulnerabilities affecting Red Hat Enterprise Linux AI 1.5 (NVIDIA). CVE-2025-48379 is a heap-based buffer overflow in the Pillow library caused by lack of size checking when writing DDS image data into an internal buffer, allowing local attackers to execute arbitrary code or cause denial of service. CVE-2025-47277 is also referenced but without detailed technical information. The vulnerabilities affect the Red Hat Enterprise Linux AI platform used for developing and running Granite family large language models. Red Hat has not released patches for these issues yet and currently no mitigations meet their criteria for ease of use and applicability.

Successful exploitation of CVE-2025-48379 can lead to local arbitrary code execution with the privileges of the user running the affected application or cause application crashes resulting in denial of service. The impact for CVE-2025-47277 is not detailed but is considered high severity. There are no known exploits in the wild at this time.

No official fix or patch is currently available from Red Hat for these vulnerabilities. Red Hat states that available mitigation options do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for updates and consider restricting local access to affected systems to reduce risk until patches are released.