CVE-2026-56208: Red Hat Ai Inference Server

High severity, CVSS 7.6. EPSS: 0.4% chance of exploitation in the next 30 days.

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Affected products

Red Hat Red Hat Ai Inference Server
Red Hat Red Hat Ai Inference Server 3.2: before 1787860580 (fixed in 1787860580); before 1787772157 (fixed in 1787772157); before 1787884873 (fixed in 1787884873)
Red Hat Red Hat Ai Inference Server 3.3: before 1789508287 (fixed in 1789508287); before 1789502493 (fixed in 1789502493); before 1789504371 (fixed in 1789504371); before 1789582776 (fixed in 1789582776)
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 0:140.13.0-1.el10_0 (fixed in 0:140.13.0-1.el10_0)
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support: before 0:140.13.0-1.el7_9 (fixed in 0:140.13.0-1.el7_9)
Red Hat Red Hat Enterprise Linux 8: before 0:140.13.0-1.el8_10 (fixed in 0:140.13.0-1.el8_10)
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: before 0:140.13.0-1.el8_4 (fixed in 0:140.13.0-1.el8_4)
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: before 0:140.13.0-1.el8_4 (fixed in 0:140.13.0-1.el8_4)
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: before 0:140.13.0-1.el8_6 (fixed in 0:140.13.0-1.el8_6)
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: before 0:140.13.0-1.el8_6 (fixed in 0:140.13.0-1.el8_6)
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service: before 0:140.13.0-1.el8_8 (fixed in 0:140.13.0-1.el8_8)
Red Hat Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions: before 0:140.13.0-1.el8_8 (fixed in 0:140.13.0-1.el8_8)
Red Hat Red Hat Enterprise Linux 9: before 0:140.13.0-1.el9_8 (fixed in 0:140.13.0-1.el9_8)
Red Hat Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions: before 0:140.13.0-1.el9_2 (fixed in 0:140.13.0-1.el9_2)
Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions: before 0:140.13.0-1.el9_4 (fixed in 0:140.13.0-1.el9_4)
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 0:140.13.0-1.el9_6 (fixed in 0:140.13.0-1.el9_6)
Red Hat Red Hat Enterprise Linux Ai 3.3: before 1790936334 (fixed in 1790936334); before 1790936351 (fixed in 1790936351); before 1790850900 (fixed in 1790850900); before 1790866732 (fixed in 1790866732); before 1790791893 (fixed in 1790791893); before 1790954179 (fixed in 1790954179)
Red Hat Red Hat Enterprise Linux Ai 3.3 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
Red Hat Red Hat Enterprise Linux Ai 3.4 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
Red Hat Red Hat Enterprise Linux Ai 3.5 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
Red Hat Red Hat Hardened Images: before 3.14.0-0.1.hum1 (fixed in 3.14.0-0.1.hum1)
Red Hat Red Hat Openshift Ai 3.3: before 1789137552 (fixed in 1789137552); before 1789137548 (fixed in 1789137548); before 1789137636 (fixed in 1789137636); before 1789137641 (fixed in 1789137641); before 1789137607 (fixed in 1789137607)
Red Hat Red Hat Openshift Ai 3.4: before 1786611800 (fixed in 1786611800); before 1787076778 (fixed in 1787076778); before 1787077779 (fixed in 1787077779); before 1787076481 (fixed in 1787076481); before 1788197680 (fixed in 1788197680); before 1788197530 (fixed in 1788197530); …
Red Hat Red Hat Openshift Ai 3.5: before 1788198404 (fixed in 1788198404); before 1788198407 (fixed in 1788198407); before 1788197492 (fixed in 1788197492); before 1788197542 (fixed in 1788197542); before 1788197975 (fixed in 1788197975); before 1788197512 (fixed in 1788197512); …
and 1 more

Published 2026-06-19. Last modified 2026-10-09.