CVE-2026-56211 is an out-of-bounds write vulnerability in libaom's AV1 encoder SVC layer ID control. The flaw allows an attacker to supply specially crafted video frames that overlap with internal encoder layer context structures, enabling corruption of memory pointers such as the cyclic refresh map pointer. In fork-based video processing services, this can be leveraged to brute-force the process base address and redirect control flow, resulting in arbitrary command execution. Exploitation requires the service to use libaom with SVC encoding enabled and accept attacker-controlled video frames. Red Hat has published security advisories and released updated libaom packages (version 3.14.0-0.1.hum1 and 3.14.0-1.el9ai) for Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5 respectively, which fix this vulnerability along with related CVEs.

Successful exploitation of this vulnerability can lead to remote code execution with high impact on confidentiality, integrity, and availability. An attacker can hijack control flow in the vulnerable service, potentially executing arbitrary commands remotely without privileges. This poses a significant risk to systems running vulnerable versions of libaom with SVC encoding enabled in Red Hat Enterprise Linux AI environments.

Red Hat has released updated libaom packages that fix CVE-2026-56211 as part of security advisories RHSA-2026:30814 and RHSA-2026:42875. Users should apply these updates promptly to affected Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5 to remediate the vulnerability. Details and update instructions are available at https://access.redhat.com/security/cve/CVE-2026-56211 and https://access.redhat.com/errata/. Patch status is confirmed by the vendor advisories.