CVE-2026-47262 describes a flaw in containerd where a remote attacker can supply a maliciously crafted container image that triggers uncontrolled resource consumption and memory exhaustion, causing the containerd daemon to terminate and resulting in a denial of service affecting container runtime APIs such as Docker Engine or Kubernetes. Red Hat's container platform uses CRI-O instead of containerd as the container runtime interface, and while containerd libraries are bundled for OCI image operations, the vulnerable containerd daemon and its CRI plugin are not executed. Consequently, Red Hat Hardened Images are not affected by this vulnerability. The advisory also lists an update to Red Hat Hardened Images RPMs for Kubernetes 1.36 components, but no fixes for this vulnerability are needed in Red Hat products. The vulnerability is associated with CWE-770 (Allocation of Resources Without Limits or Throttling).

If exploitable, this vulnerability could cause denial of service by exhausting system resources and terminating the container runtime process, making container APIs unavailable. However, Red Hat products are not affected because they do not execute the vulnerable containerd daemon code path. Therefore, there is no impact on Red Hat Hardened Images or related Kubernetes components.

No mitigation is required for Red Hat products as the vulnerable code path in containerd is not executed due to Red Hat's use of CRI-O as the container runtime. Users should ensure they apply the provided RPM updates for Red Hat Hardened Images as per Red Hat's instructions for general bug fixes and enhancements. For other products using containerd, consult the respective vendor advisories for remediation.