Red Hat Security Advisory: Red Hat AI Base Images 3.2.5 (CPU)

The Red Hat security advisory RHSA-2026:43711 addresses vulnerabilities in the ffmpeg component included in Red Hat Enterprise Linux AI 3.5. The primary CVE fixed is CVE-2026-8461, which involves out-of-bounds read and write issues (CWE-787, CWE-835, CWE-125). These vulnerabilities affect internal RPM packages that are not supported independently but only as part of the Red Hat AI application platform. The advisory provides updated ffmpeg packages (version 6.1.6-1.el9ai) to remediate these security flaws. The advisory recommends applying this update after ensuring all prior relevant errata are installed.

The vulnerabilities could allow out-of-bounds memory reads and writes within the ffmpeg component, potentially leading to memory corruption or crashes. However, no known exploits are reported in the wild. The impact is limited to systems running Red Hat Enterprise Linux AI 3.5 using the affected ffmpeg RPM packages.

Red Hat has released updated ffmpeg packages as part of the Red Hat Enterprise Linux AI 3.5 errata to fix these vulnerabilities. Users should apply the provided updates after confirming all previous relevant errata have been applied. No additional mitigation is required beyond installing the official patches.