Red Hat Product Security issued an advisory (RHSA-2026:43711) for Red Hat Enterprise Linux AI 3.5 addressing two security vulnerabilities (CVE-2026-8461 and CVE-2026-58049) in the ffmpeg component. Both vulnerabilities are categorized under CWE-787, indicating out-of-bounds memory access issues. The RPM packages affected are internal build artifacts and supported only within the Red Hat AI application platform. The advisory includes updated ffmpeg packages (version 6.1.6-1.el9ai) for multiple architectures (x86_64, s390x, ppc64le, aarch64) to remediate these vulnerabilities. No CVSS score is provided, but the severity is marked as high. There are no known exploits in the wild at the time of publication.

The vulnerabilities involve out-of-bounds memory access in ffmpeg, which could potentially lead to memory corruption or crashes within the Red Hat AI platform. Since the affected packages are internal to the Red Hat AI application platform, the impact is limited to deployments of this platform. No known active exploitation has been reported.

Red Hat has released updated ffmpeg packages as part of Red Hat Enterprise Linux AI 3.5 to address these vulnerabilities. Users should ensure all previously released errata relevant to their system are applied before updating to the fixed packages. The advisory references official Red Hat documentation for applying updates. Since these RPMs are internal build artifacts supported only within the Red Hat AI platform, remediation involves updating the platform's components accordingly.