This advisory addresses multiple vulnerabilities in the trivy RPMs included in Red Hat Hardened Images. The primary vulnerability, CVE-2026-15788, is an information disclosure issue in BuildKit where an untrusted user authoring a build on a Windows Container on Windows (WCOW) configured BuildKit daemon can exploit improper handling of NTFS directory junctions to read arbitrary files on the host system. This is classified under CWE-22 (Path Traversal) and CWE-835. The impact includes unauthorized reading of sensitive files, potentially bypassing security mechanisms. The advisory references updated trivy RPMs (version 0.72.0-0.1.2.hum1) for aarch64 and x86_64 architectures. No CVSS score is provided by Red Hat, but the severity is rated high. No known exploits are reported in the wild. The vendor advisory does not explicitly state a patch availability status but provides updated packages, indicating a fix is available.

The vulnerability allows an untrusted user to read arbitrary files on the host system when using BuildKit in a Windows Container on Windows environment. This leads to information disclosure, potentially exposing sensitive data and bypassing security mechanisms. There is no indication of integrity or availability impact from this specific vulnerability. No known active exploitation has been reported.

Updated RPM packages for trivy version 0.72.0-0.1.2.hum1 are available from Red Hat Hardened Images repositories. Applying these updates will address the vulnerabilities described. Since this is not a cloud service, remediation requires manual update of the affected packages. No additional mitigations or workarounds are specified in the advisory.