CVE-2026-56211: Out-of-bounds Write in Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9

CVE-2026-56211 is an out-of-bounds write vulnerability in libaom's AV1 encoder SVC layer ID control. This occurs because the encoder does not properly validate bounds, enabling crafted video frames to overlap and corrupt internal encoder structures. This flaw can lead to remote code execution if an attacker supplies malicious video frames to a system using libaom with SVC encoding enabled. Red Hat has issued security advisories and updated RPM packages (aom-3.14.0-0.1.hum1 and 3.14.0-1.el9ai versions) that fix this vulnerability in Red Hat Enterprise Linux AI 3.3 and 3.5 for RHEL 9.

Successful exploitation of this vulnerability can lead to remote code execution with no privileges required but user interaction needed (UI:R). The CVSS 3.1 score is 7.1 (high), indicating significant impact on confidentiality, integrity, and availability. The vulnerability affects systems using libaom with SVC encoding enabled that process attacker-supplied video frames.

Red Hat has released official security updates fixing CVE-2026-56211 in libaom packages for Red Hat Enterprise Linux AI 3.3 and 3.5 for RHEL 9. Users should apply these updates promptly. The fixed package versions include aom and libaom 3.14.0-0.1.hum1 and 3.14.0-1.el9ai. No additional mitigations are indicated by the vendor advisory. Patch status is confirmed as fixed by Red Hat advisories RHSA-2026:30814 and RHSA-2026:42875.