Red Hat Enterprise Linux AI 1.5 (NVIDIA) is affected by two vulnerabilities: CVE-2025-47277 and CVE-2025-48379. CVE-2025-48379 is a heap-based buffer overflow in the Pillow library, triggered by processing malicious DDS image files larger than 64k, leading to memory corruption. This can result in local arbitrary code execution or denial of service with the privileges of the user running the application. Red Hat has rated this vulnerability as Important (high severity) but currently has no fix available that meets their criteria for deployment. The advisory does not provide detailed technical information on CVE-2025-47277. No known exploits are reported in the wild. Red Hat Enterprise Linux AI 1.5 (NVIDIA) is a platform for developing and running Granite family large language models.

Successful exploitation of CVE-2025-48379 can lead to local arbitrary code execution or denial of service within the privileges of the user running the affected application. This compromises integrity and availability of the system or application. CVE-2025-47277 impact details are not explicitly described in the advisory. There are no known exploits in the wild for these vulnerabilities at this time.

Currently, no official fix or patch is available for these vulnerabilities in Red Hat Enterprise Linux AI 1.5 (NVIDIA). Red Hat states that mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and consider restricting local access to trusted users only until a fix is released. Engaging with Red Hat support or a Technical Account Manager may provide additional guidance.