CVE-2026-56211: Red Hat Ai Inference Server

High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days.

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

Affected products

  • Red Hat Red Hat Ai Inference Server
  • Red Hat Red Hat Ai Inference Server 3.2: before 1787860580 (fixed in 1787860580); before 1787772157 (fixed in 1787772157); before 1787884873 (fixed in 1787884873)
  • Red Hat Red Hat Ai Inference Server 3.3: before 1789508287 (fixed in 1789508287); before 1789502493 (fixed in 1789502493); before 1789504371 (fixed in 1789504371); before 1789582776 (fixed in 1789582776)
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux Ai 3.3: before 1790936334 (fixed in 1790936334); before 1790936351 (fixed in 1790936351); before 1790850900 (fixed in 1790850900); before 1790866732 (fixed in 1790866732); before 1790791893 (fixed in 1790791893); before 1790954179 (fixed in 1790954179)
  • Red Hat Red Hat Enterprise Linux Ai 3.3 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
  • Red Hat Red Hat Enterprise Linux Ai 3.4 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
  • Red Hat Red Hat Enterprise Linux Ai 3.5 For Rhel 9: before 0:3.14.0-1.el9ai (fixed in 0:3.14.0-1.el9ai)
  • Red Hat Red Hat Hardened Images: before 3.14.0-0.1.hum1 (fixed in 3.14.0-0.1.hum1)
  • Red Hat Red Hat Openshift Ai 3.3: before 1789137552 (fixed in 1789137552); before 1789137548 (fixed in 1789137548); before 1789137636 (fixed in 1789137636); before 1789137641 (fixed in 1789137641); before 1789137607 (fixed in 1789137607)
  • Red Hat Red Hat Openshift Ai 3.4: before 1786611800 (fixed in 1786611800); before 1787076778 (fixed in 1787076778); before 1787077779 (fixed in 1787077779); before 1787076481 (fixed in 1787076481); before 1788197680 (fixed in 1788197680); before 1788197530 (fixed in 1788197530); …
  • Red Hat Red Hat Openshift Ai 3.5: before 1788198404 (fixed in 1788198404); before 1788198407 (fixed in 1788198407); before 1788197492 (fixed in 1788197492); before 1788197542 (fixed in 1788197542); before 1788197975 (fixed in 1788197975); before 1788197512 (fixed in 1788197512); …
  • Red Hat Red Hat Openshift Ai Rhoai

Published 2026-06-19. Last modified 2026-10-09.