Threats Tagged 'cve-2026-56211'

Red Hat® AI Inference Server Model Optimization Tools

This update for libaom fixes the following issues - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650). - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651). - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653). - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).

CVE-2026-56211 is a high-severity remote code execution vulnerability in libaom, the reference AV1 codec implementation used in Red Hat Enterprise Linux AI 3.x for RHEL 9. The flaw arises from insufficient bounds validation in the AV1 encoder's SVC layer ID control, allowing crafted video frames to corrupt internal encoder structures. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames. Red Hat has released security updates addressing this vulnerability in libaom version 3.14.0-0.1.hum1 and later for multiple architectures. Users should apply these official patches to mitigate the risk.

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

The OpenShift Compliance Operator v1.9.0 is now available. See the documentation for bug fix information: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes