An arbitrary address write vulnerability (CWE-787) exists in libaom's SVC layer ID control function due to a missing bounds check. Attackers can inject a pointer into the cyclic refresh map field via crafted image pixel values, causing the encoder to write approximately 1,200 bytes at an attacker-controlled address. This vulnerability is deterministic and does not require an information leak. It affects Red Hat Enterprise Linux AI 3.3 for RHEL 9 with libaom versions >=3.5. Exploitation requires supplying frames to a network-facing libaom encoder with SVC enabled. Red Hat has issued security advisories and updated RPM packages (aom-3.14.0-1.el9ai and libaom-3.14.0-1.el9ai) that fix this issue.

Successful exploitation can result in denial of service or potential code execution on affected systems running vulnerable libaom versions with SVC enabled. The vulnerability is network exploitable without privileges and requires user interaction (supplying crafted frames). The CVSS v3.1 score is 7.1 (high severity), reflecting the potential for significant impact on availability and integrity.

Red Hat has released fixed RPM packages (aom-3.14.0-1.el9ai and libaom-3.14.0-1.el9ai) as part of Red Hat Enterprise Linux AI 3.5 updates. Users should apply these updates to remediate the vulnerability. Before applying, ensure all previously released errata relevant to your system are installed. No other mitigations or workarounds are specified in the vendor advisories.