Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3

• CVE-2026-96889 High 7.8 Librsvg: use-after-free when xml includes have duplicated entities 0.6%
• CVE-2026-87742 High 7.5 Quarkus-websockets-next: denial of service (oom) in quarkus-websockets-next via unbounded message buffering 0.8%
• CVE-2026-18393 Medium 5.4 Ffmpeg: ffmpeg: heap buffer overflow in tdsc_load_cursor() via cur_fmt_mono cursor 0.4%
• CVE-2026-12706 Medium 6.5 Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move() 0.5%
• CVE-2026-12491 Medium 4.8 Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations 0.2%
• CVE-2026-6859 High 8.8 Instructlab: instructlab: arbitrary code execution due to hardcoded `trust_remote_code=true` 0.4%
• CVE-2026-6855 High 7.1 Instructlab: instructlab: path traversal allows arbitrary directory creation and file write 0.2%
• CVE-2026-6385 Medium 6.5 Ffmpeg: ffmpeg: denial of service and potential arbitrary code execution via signed integer overflow in dvd subtitle parser 0.4%