This vulnerability in libaom's AV1 encoder involves an out-of-bounds write due to improper bounds checking of the SVC layer ID control. An attacker supplying specially crafted video frames can cause memory corruption overlapping internal encoder layer context structures. In fork-based video processing services, this can lead to hijacking of the cyclic refresh map pointer, brute forcing the process base address via crash oracles, and redirecting control flow to achieve arbitrary command execution. The vulnerability affects all versions of Red Hat Enterprise Linux AI 3.5 for RHEL 9 using libaom with SVC encoding enabled. Red Hat has issued security advisories and RPM updates (version 3.14.0-1.el9ai) to fix this issue.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (Confidentiality: Low, Integrity: High, Availability: High). Exploitation requires user interaction (UI:R) and high attack complexity (AC:H), with no privileges required (PR:N). No known exploits in the wild have been reported at this time.

Red Hat has released updated RPM packages for libaom (version 3.14.0-1.el9ai) that address CVE-2026-56211. Users of Red Hat Enterprise Linux AI 3.5 for RHEL 9 should apply these updates promptly. The updates are available via Red Hat's official errata channels and image repositories. Before applying, ensure all previous relevant errata are installed. No alternative mitigations or workarounds are specified in the vendor advisory.