This advisory from Red Hat Product Security announces an update to the Red Hat Hardened Images RPMs, including the syft package version 1.52.0-0.1.hum1 for aarch64 and x86_64 architectures. The update addresses two CVEs: CVE-2026-63209 and CVE-2026-71557. The advisory does not detail the specific technical nature of the vulnerabilities but references CWE-823 (Use of Out-of-bounds Write) and CWE-22 (Path Traversal). No CVSS score is provided. The update is available through Red Hat's official repositories and is intended to fix bugs and enhance security in the hardened images.

The vulnerabilities addressed by this update are classified as high severity and relate to potential security issues in the syft package within Red Hat Hardened Images. The exact impact is not detailed, but the associated CWEs suggest risks related to memory safety and path traversal, which could lead to unauthorized access or code execution if exploited. No known exploits in the wild have been reported at this time.

A fixed version of the syft package (1.52.0-0.1.hum1) is available from Red Hat's official repositories for the affected architectures. Users of Red Hat Hardened Images should apply this update promptly to remediate the vulnerabilities. Refer to https://images.redhat.com/ and the Red Hat advisory RHSA-2026:68808 for detailed update instructions. No additional mitigation steps are indicated by the vendor.