This vulnerability in libaom's SVC layer ID control function allows an out-of-bounds heap read due to missing bounds checking on spatial_layer_id. When an attacker sets a spatial_layer_id exceeding the configured layers, the code reads approximately 40,728 bytes beyond the heap buffer while computing a layer context array index. This can result in information disclosure (heap content leak) or denial of service (segmentation fault from accessing unmapped memory). The flaw affects Red Hat Enterprise Linux 10 where libaom is used in network-facing services that accept SVC encoder parameters.

An attacker capable of influencing SVC encoder parameters in a network-facing service can exploit this vulnerability to read out-of-bounds heap memory, leading to potential information disclosure. Additionally, exploitation may cause a denial of service due to segmentation faults from accessing invalid memory regions. The CVSS score of 8.2 indicates high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impact primarily on confidentiality and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-56210 for current remediation guidance. Until an official fix is available, restrict or monitor access to network-facing services that accept SVC encoder parameters to reduce exposure. Avoid processing untrusted or malformed AV1 video streams that could trigger this vulnerability.