This advisory covers two vulnerabilities affecting Red Hat Enterprise Linux AI 1.5 (NVIDIA). CVE-2025-48379 is a heap-based buffer overflow in the Pillow library caused by insufficient size checking when writing DDS image data larger than 64k, potentially leading to local arbitrary code execution or denial of service. CVE-2025-47277 details are limited but it is grouped with CVE-2025-48379 in this advisory. No official patches or fixes have been released for Red Hat Enterprise Linux AI 1.5. The vulnerabilities require local access and low privileges to exploit. Red Hat rates the severity as high and currently does not provide mitigations meeting their criteria for ease of deployment and stability.

Successful exploitation of CVE-2025-48379 can lead to local arbitrary code execution with the privileges of the user running the vulnerable application or cause application crashes resulting in denial of service. The impact includes potential compromise of application integrity and availability. CVE-2025-47277 is also considered high severity but specific impact details are not provided. There are no known exploits in the wild at this time.

No official fixes or patches are currently available for these vulnerabilities in Red Hat Enterprise Linux AI 1.5 (NVIDIA). Red Hat has indicated that available mitigations do not meet their criteria for ease of use, applicability, or stability. Users should monitor Red Hat advisories for updates and consider upgrading to future versions once fixes are released. Until then, restricting local access to trusted users may reduce risk.