CVE-2026-56210: Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-19 · updated 2026-10-19
Weakness: CWE-125

Description

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

Affected products

Red Hat AI Inference Server: all versions
Red Hat AI Inference Server 3.2: all versions — fixed in 1787772157, 1787860580, 1787884873
Red Hat AI Inference Server 3.3: all versions — fixed in 1789502493, 1789504371, 1789508287, 1789582776
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Enterprise Linux AI 3.3: all versions — fixed in 1790791893, 1790850900, 1790866732, 1790936334, 1790936351, 1790954179
Red Hat Enterprise Linux AI 3.3 for RHEL 9: all versions — fixed in 0:3.14.0-1.el9ai
Red Hat Enterprise Linux AI 3.4 for RHEL 9: all versions — fixed in 0:3.14.0-1.el9ai
Red Hat Enterprise Linux AI 3.5 for RHEL 9: all versions — fixed in 0:3.14.0-1.el9ai
Red Hat Hardened Images: all versions — fixed in 3.14.0-0.1.hum1
Red Hat OpenShift AI 3.3: all versions — fixed in 1789137548, 1789137552, 1789137607, 1789137636, 1789137641
Red Hat OpenShift AI 3.4: all versions — fixed in 1786611800, 1787076481, 1787076778, 1787077779, 1788197530, 1788197549
Red Hat OpenShift AI 3.5: all versions — fixed in 1788197385, 1788197492, 1788197512, 1788197542, 1788197688, 1788197975

How to fix

Upgrade to a fixed version: Red Hat AI Inference Server 3.2 1787772157, 1787860580, 1787884873; Red Hat AI Inference Server 3.3 1789502493, 1789504371, 1789508287, 1789582776; Red Hat Enterprise Linux AI 3.3 1790791893, 1790850900, 1790866732, 1790936334; Red Hat Enterprise Linux AI 3.3 for RHEL 9 0:3.14.0-1.el9ai; Red Hat Enterprise Linux AI 3.4 for RHEL 9 0:3.14.0-1.el9ai; Red Hat Enterprise Linux AI 3.5 for RHEL 9 0:3.14.0-1.el9ai; Red Hat Hardened Images 3.14.0-0.1.hum1; Red Hat OpenShift AI 3.3 1789137548, 1789137552, 1789137607, 1789137636; Red Hat OpenShift AI 3.4 1786611800, 1787076481, 1787076778, 1787077779; Red Hat OpenShift AI 3.5 1788197385, 1788197492, 1788197512, 1788197542. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56210 or the next vulnerability affects your stack