Red Hat Security Advisory: Red Hat AI Inference Server 3.3.3 (CUDA)

Weakness classes (CWE)

• CWE-190Base

  Integer Overflow or Wraparound

  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

  cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Translated2026-07-24 21:10 UTC· nvd@nist.gov
   • Translation: Title: Pillow de python-pillow, Description: Pillow es una biblioteca de procesamiento de imágenes de Python. Antes de la versión 12.2.0, si una fuente avanza para cada glifo una cantidad excesivamente grande, cuando Pillow rastrea la posición actual, esto puede provocar un desbordamiento de entero. Este problema ha sido parcheado en la versión 12.2.0.

Affected operating systems

• linux

  debian / debian_linux11.0

• linux

  redhat / enterprise_linux10.0

• linux

  redhat / enterprise_linux6.0

• linux

  redhat / enterprise_linux7.0

• linux

  redhat / enterprise_linux8.0

• linux

  redhat / enterprise_linux9.0

• linux

  redhat / enterprise_linux_server_aus8.2

• linux

  redhat / enterprise_linux_server_aus8.4

• linux

  redhat / enterprise_linux_server_tus8.8

• linux

  ubuntu / giflibjammy

• linux

  ubuntu / giflibnoble

• linux

  ubuntu / giflibresolute

• linux

  canonical / ubuntu_linux20.04

• linux

  canonical / ubuntu_linux22.04

• linux

  canonical / ubuntu_linux24.04

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

• bitnami

  pillow10.3.0

• bitnami

  pillow11.2.1

• bitnami

  pillow4.2.0

• bitnami

  pillow

• canonical

  ubuntu_linux

• gnome

  gdk-pixbuf

• libarchive

  libarchive

• nghttp2

  nghttp21.68.1

• openbsd

  openssh

• openexr

  openexr3.3.0 – 3.3.8

• openexr

  openexr3.4.0 – 3.4.6

• openexr

  openexr3.2.6

• pypi

  cbor21.0.0

• pypi

  cbor21.1.0

• pypi

  cbor22.0.0

• pypi

  cbor23.0.0

• pypi

  cbor23.0.1

• pypi

  cbor23.0.2

• pypi

  cbor23.0.3

• pypi

  cbor23.0.4

• pypi

  cbor24.0.0

• pypi

  cbor24.0.1

• pypi

  cbor24.1.0

• pypi

  cbor24.1.1

References & sources

• https://github.com/python-pillow/Pillow/security/advisories/GHSA-r73j-pqj5-w3x7
  web
• https://nvd.nist.gov/vuln/detail/CVE-2026-42310
  advisory
• https://github.com/python-pillow/Pillow/pull/9519
  web
• https://github.com/python-pillow/Pillow/commit/3bf614e4b8615d0ce1d5039efaf6db447fe7c468
  web
• https://github.com/python-pillow/Pillow
  package
• https://github.com/python-pillow/Pillow/releases/tag/12.2.0
  web
• https://pypi.org/project/pillow
  package
• https://github.com/advisories/GHSA-r73j-pqj5-w3x7
  advisory
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-5xmw-vc9v-4wf2
  advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42309
  web
• https://access.redhat.com/errata/RHSA-2026:10065
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:10097
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:11768
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:12071
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:12274
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:13812
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:14773
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:14937
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:15087
  vendor-advisoryx_refsource_REDHAT
• https://access.redhat.com/errata/RHSA-2026:16008
  vendor-advisoryx_refsource_REDHAT

Linked CVEs

• CVE-2026-5201

  A flaw was found in the gdk-pixbuf library.

  highCVSSv3 7.5
• CVE-2026-5121

  A flaw was found in libarchive.

  highCVSSv3 7.5
• CVE-2026-4519

  A flaw was found in Python.

  highCVSSv3 7.1
• CVE-2026-4424

  A flaw was found in libarchive.

  highCVSSv3 7.5
• CVE-2026-42311

  A flaw was found in Pillow, a Python imaging library.

  highCVSSv3 7.8
• CVE-2026-42310

  Pillow is a Python imaging library.

  mediumCVSSv3 5.5
• CVE-2026-42309

  Pillow is a Python imaging library.

  mediumCVSSv3 5.5
• CVE-2026-40192

  A flaw was found in Pillow, a Python imaging library.

  highCVSSv3 7.5
• CVE-2026-3497

  A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Lin…

  highCVSSv3 7.5
• CVE-2026-27622

  OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture in…

  highCVSSv3 7.8
• CVE-2026-27135

  A flaw was found in nghttp2.

  highCVSSv3 7.5
• CVE-2026-26209

  cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format.

  highCVSSv3 7.5
• CVE-2026-23868

  A flaw was found in giflib.

  mediumCVSSv3 5.1