CVE-2026-56208 describes a heap buffer overflow in libaom's AV1 encoder within Red Hat Enterprise Linux 10. The vulnerability arises from a bypass of the first-pass stats ring buffer wrap-around guard when the g_lag_in_frames parameter is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap memory. An attacker able to influence encoder configuration in services such as transcoding or WebRTC could exploit this flaw to cause a process crash or potentially execute arbitrary code.

The vulnerability can cause denial of service through process crashes due to heap corruption. Additionally, there is potential for remote code execution if an attacker can manipulate encoder configuration parameters in affected environments. The CVSS 3.1 score of 8.6 (high) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-56208 for current remediation guidance. No official fix or workaround details are provided in the available data. Users should monitor the vendor advisory for updates and apply patches once released.