This Red Hat security advisory addresses four high-severity vulnerabilities (CVE-2026-56208, CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) in the aom package included in Red Hat Hardened Images RPMs. The vulnerabilities correspond to memory safety issues categorized under CWE-122 (Heap-based Buffer Overflow), CWE-787 (Out-of-bounds Write), and CWE-125 (Out-of-bounds Read). Affected packages include aom and libaom variants for multiple architectures (aarch64, x86_64, s390x, ppc64le) and source RPMs. The advisory covers Red Hat Enterprise Linux AI 3.4 and 3.5 for RHEL 9. Updated RPM packages (version 3.14.0-0.1.hum1 and 3.14.0-1.el9ai) have been released to fix these vulnerabilities. The advisory does not mention any known exploits in the wild. The vendor recommends applying the updates as the remediation.

The vulnerabilities involve memory safety issues such as heap-based buffer overflows and out-of-bounds reads/writes in the aom package, which could potentially lead to denial of service or code execution if exploited. The high severity rating indicates significant risk if these vulnerabilities are exploited. However, there are no reports of active exploitation in the wild at this time. The impact is limited to systems running the affected versions of Red Hat Hardened Images RPMs, particularly Red Hat Enterprise Linux AI 3.4 and 3.5 for RHEL 9 on supported architectures.

Red Hat has released updated RPM packages for the aom package and related libraries to address these vulnerabilities. Users should apply these security updates promptly to mitigate the risks. The advisory provides links to the updated packages and instructions for applying the updates. There is no indication that additional mitigation steps are required beyond applying the official patches. No cloud service remediation is involved as this is not a cloud service. Patch status is confirmed by the vendor advisory.