CVE-2026-56208: libaom: heap overflow in AV1 encoder LAP mode

A heap buffer overflow in libaom's AV1 encoder look-ahead processing (LAP) mode lets an attacker who can influence encoder settings in a transcoding service or WebRTC session trigger a 232-byte out-of-bounds heap write on every frame encoded after the second, progressively corrupting adjacent memory. This isn't an AI-specific attack technique, but libaom ships as a transitive dependency inside 129 downstream packages, including several Red Hat AI Inference Server (rhaii/rhaiis) and OpenShift AI (rhoai) container images that back vLLM-based model-serving stacks — so remediation means rebuilding and redeploying those base images, not patching model code. Exploitation likelihood is currently low: EPSS sits at 0.275% (81st percentile among scored CVEs), there's no public PoC, no Nuclei template, and it isn't in CISA's KEV — but the flaw needs no privileges, only network reach and one user interaction (e.g., accepting a video/WebRTC call), and repeated per-frame corruption gives an attacker room to escalate from a crash to code execution with sufficient heap grooming. Track Red Hat's RHSA-2026:30814 and the upstream libaom fix (commit 243f8ae84b), and prioritize rebuilding any AI-serving container image that bundles libaom directly or transitively via Firefox/Thunderbird packages, rather than treating this as a routine codec patch.

No confirmed active exploitation of CVE-2026-56208 has been reported, but organizations should still patch proactively.

1) Patch libaom to the fixed version referenced in upstream commit 243f8ae84b and Red Hat advisory RHSA-2026:30814; track bugzilla #2490799 for downstream status. 2) Rebuild and redeploy any rhaii/rhaiis/rhoai or vLLM container image that bundles libaom (directly or via firefox/thunderbird) rather than waiting for a routine base-image refresh cycle. 3) If encoder configuration is exposed to end users or untrusted callers in any transcoding/WebRTC service, disable or hardcode g_lag_in_frames to 0 as an interim workaround to prevent LAP mode from activating. 4) Add input validation / allowlisting on any user-influenceable encoder parameters in transcoding services. 5) For detection, monitor transcoding/media-processing workers for unexplained segfaults or crash-loops correlated with video sessions of more than 2 encoded frames, and alert on anomalous heap-corruption crash signatures (ASan/heap-corruption detectors in staging can help validate exposure pre-patch).

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal preprocessing pipelines, containerized AI inference infrastructure.

CVE-2026-56208 has a CVSS v3.1 base score of 7.6 (HIGH). The EPSS exploitation probability is 0.35%.