This advisory covers two vulnerabilities affecting Red Hat Enterprise Linux AI 1.5 (NVIDIA). The primary technical detail concerns CVE-2025-48379, a heap-based buffer overflow in the Pillow library caused by lack of size checking when writing DDS image data into an internal buffer. Exploitation requires local access and can result in arbitrary code execution with the privileges of the user running the application or cause denial of service. The advisory also references CVE-2025-47277 but provides no detailed technical information on it. No patches or fixes have been released for these vulnerabilities as of the advisory date. Red Hat rates the impact as important/high and recommends users consult their technical account managers for mitigation strategies.

Successful exploitation of CVE-2025-48379 can lead to local arbitrary code execution or denial of service conditions within the context of the user running the vulnerable application. This can compromise the integrity and availability of the affected system. No known exploits are reported in the wild. The impact of CVE-2025-47277 is not detailed in the provided data. Overall, these vulnerabilities pose a high risk to affected Red Hat Enterprise Linux AI 1.5 installations if exploited locally.

No official fix or patch is currently available for these vulnerabilities. Red Hat advises affected users to consult with their Technical Account Managers (TAM) for possible mitigation options. Since no vendor-provided mitigations are confirmed, users should monitor Red Hat advisories for updates and consider restricting local access to vulnerable systems until a fix is released. Avoid processing untrusted DDS image files with the Pillow library where possible.