CVE-2026-40170 is a high-severity vulnerability affecting the ngtcp2 RPM packages included in Red Hat Hardened Images. The issue is categorized under CWE-120, which typically relates to buffer overflow or similar memory corruption vulnerabilities. The advisory lists updated RPM packages for ngtcp2 version 1.22.1-1.hum1 for aarch64 and x86_64 architectures, suggesting a bug fix and enhancement update. However, the vendor advisory content does not explicitly confirm patch availability or provide specific remediation instructions. There are no known exploits in the wild reported at this time.

The vulnerability is classified as high severity and relates to a buffer-related weakness (CWE-120) in ngtcp2 packages. Such vulnerabilities can potentially lead to memory corruption, which may be exploitable to cause denial of service or code execution depending on the context. No confirmed exploitation in the wild has been reported. The impact is limited to affected Red Hat Hardened Images RPM packages for ngtcp2 on aarch64 and x86_64 architectures.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-40170 for current remediation guidance. Since the advisory mentions an update including new RPM versions, it is recommended to monitor Red Hat's official channels for the release and apply updates promptly once available. No explicit vendor instructions for mitigation or workarounds are provided in the advisory content.