This vulnerability involves a heap buffer overflow in libaom's AV1 encoder Look-Ahead Processing mode. Specifically, when g_lag_in_frames is set to 1 or higher, the first-pass stats ring buffer wrap-around guard is bypassed, leading to a 232-byte out-of-bounds write on every encoded frame after the second. This corrupts adjacent heap objects and can be exploited by attackers who control encoder configuration in transcoding services or WebRTC sessions to cause denial of service or potentially execute code. Red Hat has issued security advisories RHSA-2026:30814 and RHSA-2026:42875 providing updated RPM packages for affected systems, including Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5. The fixed libaom version is 3.14.0-0.1.hum1 or later.

The vulnerability allows an attacker with the ability to influence AV1 encoder configuration to cause a denial of service via process crashes or potentially achieve arbitrary code execution due to heap corruption. The CVSS v3.1 score is 7.6 (high severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and low confidentiality and integrity impact but high availability impact.

Red Hat has released fixed versions of the libaom packages (version 3.14.0-0.1.hum1 and 3.14.0-1.el9ai) that address this vulnerability. Users should apply these security updates as detailed in Red Hat advisories RHSA-2026:30814 and RHSA-2026:42875. Before applying these updates, ensure all previously released errata relevant to your system have been applied. No other mitigations are specified by the vendor.