An out-of-bounds write vulnerability (CWE-787) exists in libaom's SVC layer ID control function due to a missing bounds check. This allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then deterministically writes approximately 1,200 bytes at the attacker-controlled address without requiring an information leak. Exploitation requires supplying frames to a network-facing libaom encoder with SVC enabled. Red Hat has published security advisories and updated RPM packages (aom-3.14.0-1.el9ai and libaom-3.14.0-1.el9ai) for Red Hat Enterprise Linux AI 3.5 to fix this vulnerability.

The vulnerability enables an attacker to perform an arbitrary write of about 1,200 bytes to a memory address controlled by the attacker. This can lead to denial of service or potentially remote code execution on systems running a vulnerable libaom encoder with SVC enabled. The CVSS score of 7.1 reflects a high severity impact with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Red Hat has released updated RPM packages for libaom as part of Red Hat Enterprise Linux AI 3.5 to address CVE-2026-56209. Users should apply the security update RHSA-2026:42875 or later, which includes libaom-3.14.0-1.el9ai and related packages, to remediate this vulnerability. Before applying the update, ensure all previously released errata relevant to your system have been applied. No other mitigations are specified by Red Hat.