This Red Hat security advisory addresses four vulnerabilities (CVE-2026-56208, CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) in the aom package, which is part of Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5. The affected packages include aom and libaom RPMs version 3.14.0-0.1.hum1 and 3.14.0-1.el9ai for multiple architectures (aarch64, x86_64, s390x, ppc64le). The vulnerabilities relate to memory safety issues such as heap-based buffer overflows and out-of-bounds reads/writes (CWE-122, CWE-787, CWE-125). Red Hat has released updated RPMs to address these issues. The packages are internal build artifacts and supported only within the Red Hat AI application platform. No CVSS scores are published, but the severity is rated high/important by Red Hat. No known exploits in the wild have been reported at this time.

The vulnerabilities affect the aom package used in Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5, potentially leading to memory safety issues such as buffer overflows and out-of-bounds memory access. These issues could allow attackers to cause application crashes or potentially execute arbitrary code if exploited. The affected packages span multiple architectures (aarch64, x86_64, s390x, ppc64le). No known active exploitation has been reported. The impact is considered high by Red Hat, indicating significant risk if unpatched.

Red Hat has released updated RPM packages (aom-3.14.0-0.1.hum1 and aom-3.14.0-1.el9ai) that fix the identified vulnerabilities. Users of Red Hat Hardened Images and Red Hat Enterprise Linux AI 3.5 should apply these updates promptly. The RPM packages are internal build artifacts and supported only as part of the Red Hat AI application platform. Before applying the update, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official advisories (RHSA-2026:30814 and RHSA-2026:42875) and the Red Hat images portal for detailed update instructions. No additional mitigation steps are indicated by the vendor.