The vulnerability CVE-2025-48379 affects the Pillow image processing library used in Red Hat Enterprise Linux AI 1.5 (AMD). It is a heap-based buffer overflow (CWE-122) triggered by processing a malicious DDS image larger than 64k when encoded. This overflow occurs because the library writes more data than the allocated buffer can hold, leading to memory corruption. Successful exploitation can result in local arbitrary code execution with the privileges of the user running the application or cause a denial of service by crashing the application. Red Hat has classified this vulnerability as important/high severity but currently has no available fix or mitigation that meets their criteria for ease of use, deployment, and stability. The advisory references CVE-2025-47277 as well but provides no additional details or fixes for it.

A local attacker can exploit this vulnerability by tricking an application that uses the Pillow library into processing a specially crafted DDS image file. This can lead to arbitrary code execution within the privileges of the user running the application or cause the application to crash, resulting in denial of service. There are no known exploits in the wild at this time. The vulnerability affects the integrity and availability of affected systems.

Currently, no official fix or patch is available for this vulnerability in Red Hat Enterprise Linux AI 1.5 (AMD). Red Hat Product Security states that available mitigations either do not exist or do not meet their criteria for deployment and stability. Users should monitor Red Hat advisories for updates and consider restricting local access to trusted users to reduce risk until a fix is released.