The vulnerability CVE-2026-56210 involves a missing bounds check in the Scalable Video Coding (SVC) layer ID control function of libaom, the reference AV1 codec implementation. This allows setting a spatial_layer_id that exceeds the configured number of layers, resulting in an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker capable of influencing SVC encoder parameters in a network-facing service could exploit this flaw to disclose heap memory contents or cause a denial of service due to a segmentation fault from accessing unmapped memory. The issue affects Red Hat Enterprise Linux AI 3.5 for RHEL 9 with libaom versions >=3.5. Red Hat has issued security advisories and released updated RPM packages (aom-3.14.0-1.el9ai and libaom-3.14.0-1.el9ai) that fix this vulnerability.

Successful exploitation of this vulnerability can lead to limited confidentiality loss through information disclosure of heap contents or cause denial of service by crashing the affected service. The CVSS v3.1 base score is 7.1 (High), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact.

Red Hat has released updated packages (aom-3.14.0-1.el9ai, libaom-3.14.0-1.el9ai, and related packages) that address CVE-2026-56210. Users of Red Hat Enterprise Linux AI 3.5 for RHEL 9 should apply these updates promptly. Before applying this update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official advisories (RHSA-2026:30814 and RHSA-2026:42875) and update instructions at https://access.redhat.com/articles/11258 for detailed guidance. Patch status is confirmed as fixed in version 3.14.0-1.el9ai.