This Red Hat security advisory announces an update to the Red Hat Hardened Images RPMs, including the grype package version 0.119.0-0.1.hum1 for aarch64 and x86_64 architectures. The update addresses two vulnerabilities: CVE-2026-63209 and CVE-2026-71557. The advisory does not specify the exact nature of the vulnerabilities beyond referencing CWE-823 (Use of Out-of-bounds Write) and CWE-22 (Path Traversal). The advisory does not list affected versions explicitly but provides the updated package versions. No CVSS score is provided, and no known exploits in the wild are reported.

The vulnerabilities addressed are rated as high severity, indicating a significant security risk if exploited. The specific impacts are not detailed in the advisory, but the referenced CWEs suggest potential memory corruption and path traversal issues, which could lead to unauthorized access or code execution if exploited.

A fix is available via the updated RPM packages grype-0.119.0-0.1.hum1 for aarch64 and x86_64 architectures. Users of Red Hat Hardened Images should apply this update as per Red Hat's instructions available at https://images.redhat.com/. No additional mitigation steps are indicated in the advisory.