{"schema":"vulnpedia.research/1","cve":"CVE-2026-112390","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9","tags":["x_refsource_CONFIRM","exploit","Exploit","Patch","Vendor Advisory","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-10-20T15:02:38.367Z","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"source":"nvd","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:01:18.697","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://github.com/python-pillow/Pillow/security/advisories/GHSA-22hg-r758-rrw9"}]},{"url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218","tags":["x_refsource_MISC","Patch","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"source":"nvd","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:01:18.697","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://github.com/python-pillow/Pillow/commit/26cb3ed061173b817b9ee4b6f507cb0e1e293218"}]},{"url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0","tags":["x_refsource_MISC","Release Notes","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-19T20:35:39.189Z","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"nvd","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:01:18.697","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://github.com/python-pillow/Pillow/releases/tag/13.0.0"}]},{"url":"https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","origins":[{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","origins":[{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390"},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112390"}]},{"url":"https://github.com/python-pillow/Pillow","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","origins":[{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://github.com/python-pillow/Pillow"},{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://github.com/python-pillow/Pillow"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-112390","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-112390"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555848","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555848"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-112390","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-112390"}]},{"source":"euvd","sourceId":"EUVD-2026-104598","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104598","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-104598","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104598"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","url":"https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9","ecosystem":"PyPI","name":"pillow","purl":"pkg:pypi/pillow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0"},{"fixed":"13.0.0"}]}],"versions":["10.0.0","10.0.1","10.1.0","10.2.0","10.3.0","10.4.0","11.0.0","11.1.0","11.2.1","11.3.0","12.0.0","12.1.0","12.1.1","12.2.0","12.3.0","7.2.0","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.3.0","8.3.1","8.3.2","8.4.0","9.0.0","9.0.1","9.1.0","9.1.1","9.2.0","9.3.0","9.4.0","9.5.0"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-22hg-r758-rrw9/GHSA-22hg-r758-rrw9.json"},"modified":"2026-10-26T08:56:03.565713059Z","origins":[{"source":"ghsa","sourceId":"GHSA-22hg-r758-rrw9","modified":"2026-10-26T08:56:03.565713059Z","url":"https://osv.dev/vulnerability/GHSA-22hg-r758-rrw9"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"exploit_intelligence:exploit-intelligence/vulnerability-analysis-rhel9","product":"exploit-intelligence/vulnerability-analysis-rhel9 as a component of Exploit Intelligence","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vulnerability-analysis-rhel9@sha256:64fb01357ccdad3fde5b4448664a57967117e94418a26c6d8022fb4a7f31a4de?repository_url=registry.redhat.io/exploit-intelligence/vulnerability-analysis-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"openshift_lightspeed:openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9","product":"openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 as a component of OpenShift Lightspeed","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/lightspeed-rag-tool-rhel9@sha256:fb2ea7e901d290ab2e64cb9070690ba3a1dd0f621d27b379d1b75e0d315a803a?repository_url=registry.redhat.io/openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ai_inference_server:rhaii/vllm-cpu-rhel9","product":"rhaii/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vllm-cpu-rhel9@sha256:f8a692451f509d11bf166288d614660cf8c15bab7494a822276bf458cfeb757a?repository_url=registry.redhat.io/rhaii/vllm-cpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ai_inference_server:rhaii/vllm-rocm-rhel9","product":"rhaii/vllm-rocm-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vllm-rocm-rhel9@sha256:7b64ac6e235a073d437c3da172c537347c7b54092c09d4ca11594b52ddbd1852?repository_url=registry.redhat.io/rhaii/vllm-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-cuda-rhel9","product":"rhaiis/vllm-cuda-rhel9 as a component of Red Hat AI Inference Server","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/vllm-cuda-rhel9@sha256:73bbc4560132c4aaa9bbd608ce9560eeae7b30bcc8f014da460afa5622139372?repository_url=registry.redhat.io/rhaiis/vllm-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform-26/hub-rhel9","product":"ansible-automation-platform-26/hub-rhel9 as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/hub-rhel9@sha256:a89626cb36ee12ab3e31794662d3c791e0b3d3e7e9f4fb4624c0c4c096c0d445?repository_url=registry.redhat.io/ansible-automation-platform-26/hub-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:python3.12-pillow.src","product":"python3.12-pillow.src as a component of Red Hat Ansible Automation Platform 2","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9ap?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_enterprise_linux_8:python3-pillow-doc","product":"python3-pillow-doc as a component of Red Hat Enterprise Linux 8","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python3-pillow-doc","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-azure-rocm-rhel9","product":"rhelai3/bootc-azure-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-azure-rocm-rhel9@sha256:87723c21f48eb371968e2d68346953f2a03a3cf643a967801b84696ee3e1f1e8?repository_url=registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_enterprise_linux_ai_(rhel_ai)_3:rhelai3/bootc-rocm-rhel9","product":"rhelai3/bootc-rocm-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/bootc-rocm-rhel9@sha256:8fe5203e86917e5f829bd64b831cad31536d23a213b4bfe31e652577ad0faf2e?repository_url=registry.redhat.io/rhelai3/bootc-rocm-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhai-early-access/docling-serve-cuda-rhel9","product":"rhai-early-access/docling-serve-cuda-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/docling-serve-cuda-rhel9@sha256:d4393882dd9adc9ee6fd03265bb20d90944906a4fa6b37db5b0a47df36ebac75?repository_url=registry.redhat.io/rhai-early-access/docling-serve-cuda-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-autorag-rhel9","product":"rhoai/odh-autorag-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-autorag-rhel9@sha256:27d0833efd8096d7311746c1a4f72699b945b2b2fa88ed47073eba96bb3b9503?repository_url=registry.redhat.io/rhoai/odh-autorag-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-kserve-autogluon-server-rhel9","product":"rhoai/odh-kserve-autogluon-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-kserve-autogluon-server-rhel9@sha256:d16a3db7f9491439c9ffa90d81e1e45eeaa17ce64b1dbd8eaaf6a3b7948a99fa?repository_url=registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-llama-stack-core-rhel9","product":"rhoai/odh-llama-stack-core-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-llama-stack-core-rhel9@sha256:4d89196e9a333993dbb01199c418a0e3e77f32e16690a4067ef10466c2e7cb03?repository_url=registry.redhat.io/rhoai/odh-llama-stack-core-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-openvino-model-server-rhel9","product":"rhoai/odh-openvino-model-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-openvino-model-server-rhel9@sha256:b850e7e0a37c02ac0bca3967fa80c9954f3d83cfde031687d85f2045a52f6cdb?repository_url=registry.redhat.io/rhoai/odh-openvino-model-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","product":"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-pipeline-runtime-pytorch-rocm-py312-rhel9@sha256:8bf2de878394390a6254b889783bd87185b573d93487055364326e864a404dc7?repository_url=registry.redhat.io/rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th-torch-cuda-py312-rhel9","product":"rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"rhoai/odh-th06-rocm64-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-th06-rocm64-torch291-py312-rhel9@sha256:b2a253f3dc063a8e1cee441640cce13fcf04918ce453be8f5d488301b1458a91?repository_url=registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-trustyai-nemo-guardrails-server-rhel9","product":"rhoai/odh-trustyai-nemo-guardrails-server-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-trustyai-nemo-guardrails-server-rhel9@sha256:c10ff17d1912fe7a7b15b05923cefac72b355bbfb91b19f82c1d179596a7775a?repository_url=registry.redhat.io/rhoai/odh-trustyai-nemo-guardrails-server-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","product":"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9@sha256:af7c11030f155c3d07465e65ed7aff32861e3893e838d9d744e5bb3700f865dd?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","product":"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:oci/odh-workbench-jupyter-trustyai-cpu-py312-rhel9@sha256:90da115e64c80fbf57802442848ff8eee18d8c38e6e30edfdb374bb94dd84735?repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_satellite_6:python3.12-pillow.src","product":"python3.12-pillow.src as a component of Red Hat Satellite 6","status":"known_affected","remediations":[{"category":"workaround","details":"--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to prevent Pillow from enumerating or extracting frames from untrusted Microsoft Image Composer (MIC) files when olefile is installed: upgrade to Pillow 13.0.0 (or the fixed Python Pillow/Python3.11 Pillow/Rhoai/Odh Openvino Model Server Rhel/Rhelai3/Bootc Cuda Rhel/Rhelai3/Bootc Gaudi Rhel/Rhelai3/Bootc Rocm Rhel/Rhelai3/Disk Image Cuda Rhel/Python3X Pillow/Rhaiis/Vllm Spyre Rhel/Rhoai/Odh Kserve Storage Initializer Rhel/Rhoai/Odh Kserve Agent Rhel/Rhoai/Odh Kserve Controller Rhel/Rhoai/Odh Kserve Router Rhel/Rhoai/Odh Feature Server Rhel/Rhoai/Odh Trustyai Nemo Guardrails Server Rhel/Rhaiis/Vllm Tpu Rhel/Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Training Rocm64 Torch29 Py312 Rhel/Rhaiis/Vllm Cpu Rhel/Rhaiis/Vllm Neuron Rhel/Ansible Automation Platform 25/Lightspeed Chatbot Rhel/Openshift Lightspeed/Lightspeed Ocp Rag Rhel/Rhoai/Odh Th06 Cpu Torch291 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch291 Py312 Rhel/Rhoai/Odh Vllm Gaudi Rhel/Python3.12 Pillow/Rhaii/Vllm Gaudi Rhel/Rhaii/Vllm Neuron Rhel/Rhaii/Vllm Tpu Rhel/Lightspeed Core/Lightspeed Stack Rhel/Rhoai/Odh Kserve Autogluon Server Rhel/Rhai Early Access/Docling Sdk Cuda Rhel/Rhai Early Access/Docling Serve Cuda Rhel/Rhoai/Odh Llm D Kv Cache Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Ask Sre/Rhel Cla/Rlsapi Rhel/Rhaiis/Model Opt Cuda Rhel/Rhaiis/Vllm Cuda Rhel/Rhaiis/Vllm Rocm Rhel/Rhaii/Model Opt Cuda Rhel/Rhaii/Vllm Cpu Rhel/Rhaii/Vllm Cuda Rhel/Rhaii/Vllm Rocm Rhel/Rhaii/Vllm Spyre Rhel/Ansible Automation Platform/Automation Dashboard Rhel/Ansible Automation Platform 26/Hub Rhel/Ansible Automation Platform 26/Lightspeed Chatbot Rhel/Ansible Automation Platform 27/Hub Rhel/Ansible Automation Platform 27/Lightspeed Chatbot Rhel/Galaxy Ng/Automation Hub Container/Aap Rag Content/Ansible Chatbot Stack/Koku Report Emailer/Exploit Intelligence/Vulnerability Analysis Rhel/Insights Host Inventory/Google Lightspeed Agent/Lscore Deploy/Lightspeed Core/Rag Tool Cpu Rhel/Lightspeed Core/Rag Tool Cuda 12.9 Rhel/Lightspeed Services Ocp/Ocp Rules Rhel/Openshift Lightspeed Tech Preview/Lightspeed Rag Tool Rhel/Openshift Lightspeed/Lightspeed Service Api Rhel/Rhoai/Odh Caikit Tgis Serving Rhel/Rhoai/Odh Llama Stack Core Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Automl Rhel/Rhoai/Odh Autorag Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Trustyai Garak Lls Provider Dsp Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhai/Guidellm Rhel/Rhoai/Odh Ogx Core Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Quay/Quay Service Tool/Quay/Quay Rhel/Rhelai3/Bootc Aws Cuda Rhel/Rhelai3/Bootc Azure Cuda Rhel/Rhelai3/Bootc Azure Rocm Rhel/Rhelai3/Bootc Gcp Cuda Rhel builds), which initialize _n_frames in __init__ instead of resetting it in _open(), and avoid re-setting _n_frames and is_animated in _seek() if already set, closing crafted Microsoft Image Composer (MIC) file with an embedded TIFF containing three or more IFDs. Until patched, this is a concern on Applications running Pillow 7.2.0 through 12.3.0 with olefile installed that query n_frames or extract frames from untrusted input, so Reject or sanitize untrusted MIC file uploads at ingestion and avoid calling n_frames or save_all on unverified images in environments where olefile is loaded. As a compensating measure, Impose CPU time limits using ulimit or prlimit to terminate worker processes caught in the non-advancing MIC image parsing loop before system CPU is exhausted and Configure service watchdogs with automatic restart under systemd to detect stalled processes via keep-alives and restore availability. These controls limit blast radius and contain exploitation, but they do not fix the underlying non-advancing frame traversal defect — apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-114 Process Resource Limits (ulimit/prlimit) (medium)"},{"category":"none_available","details":"Affected"}],"purl":"pkg:rpm/redhat/python3.12-pillow@12.3.0-1.el9ap?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-cpu-rhel9","product":"rhaiis/vllm-cpu-rhel9 as a component of Red Hat AI Inference Server","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/vllm-cpu-rhel9@sha256:fb7791bbfea99e9f81529fe8cc1e7c834ca470585c27590e3d0a6834167cd436?repository_url=registry.redhat.io/rhaiis/vllm-cpu-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ai_inference_server:rhaiis/vllm-neuron-rhel9","product":"rhaiis/vllm-neuron-rhel9 as a component of Red Hat AI Inference Server","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/vllm-neuron-rhel9@sha256:8ba72cec5d79b1a751eb09774c81fd6181b43ec69a2e5116982661b34366874d?repository_url=registry.redhat.io/rhaiis/vllm-neuron-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform-25/lightspeed-chatbot-rhel8","product":"ansible-automation-platform-25/lightspeed-chatbot-rhel8 as a component of Red Hat Ansible Automation Platform 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/lightspeed-chatbot-rhel8@sha256:3e61238b7400447dfd7999d053e7f701d7c84d62e4a0ef29950c39f3843fb467?repository_url=registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:ansible-automation-platform/automation-dashboard-rhel9","product":"ansible-automation-platform/automation-dashboard-rhel9 as a component of Red Hat Ansible Automation Platform 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/automation-dashboard-rhel9@sha256:3971cc95bbedd16996776c4aadfaeac576ef3b0ad212825a4035fb40849b2bc4?repository_url=registry.redhat.io/ansible-automation-platform/automation-dashboard-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:python-pillow.src","product":"python-pillow.src as a component of Red Hat Ansible Automation Platform 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:rpm/redhat/python-pillow@10.3.0-1.el9ap?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:python3.11-pillow.src","product":"python3.11-pillow.src as a component of Red Hat Ansible Automation Platform 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:rpm/redhat/python3.11-pillow@10.3.0-1.el8ap?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_ansible_automation_platform_2:python3x-pillow.src","product":"python3x-pillow.src as a component of Red Hat Ansible Automation Platform 2","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_in_execute_path","purl":"pkg:rpm/redhat/python3x-pillow@10.3.0-1.el8ap?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","product":"rhoai/odh-th06-cpu-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:oci/odh-th06-cpu-torch291-py312-rhel9@sha256:f41414d319c2af4a36ff991b4905dd17aaeec2db0ca0af4dd5d76501b28bbb15?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch291-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":"rhoai/odh-th06-cuda130-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_not_affected","remediations":[],"justification":"component_not_present","purl":"pkg:oci/odh-th06-cuda130-torch291-py312-rhel9@sha256:4a92ec3c409a7c6ef662a2fe902e8bfff42392385f668e20fc4825d03bc838cd?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch291-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]},{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-vllm-gaudi-rhel9","product":"rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","purl":"pkg:oci/odh-vllm-gaudi-rhel9@sha256:87eec3862eb6ddef445f89dcf6fd89add7ef202ea7c563b1ee7347537fb3e250?repository_url=registry.redhat.io/rhoai/odh-vllm-gaudi-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-112390","modified":"2026-10-23T17:38:50+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112390.json"}]}],"vendorCoverage":{"total":94,"shown":32,"omitted":62,"source":"redhat"}}