CVE-2026-56210: libaom: AV1 SVC bounds-check miss leaks heap, crashes

CVE-2026-56210 is a missing bounds check in libaom's AV1 Scalable Video Coding layer-ID handling that lets an attacker set a spatial_layer_id beyond the configured layer count, forcing an out-of-bounds heap read of roughly 40KB. This matters because libaom ships as a base dependency across every Red Hat AI Inference Server and OpenShift AI container variant tracked here — CPU, CUDA 12.9/13.0, ROCm 6.4/7.0/7.1, Gaudi, Neuron, TPU and Spyre images, plus every vLLM build, KServe, AutoML, AutoRAG and workbench image — and the package graph shows 129 downstream dependents, so unpatched-image footprint is wide even though libaom itself is not AI-specific logic. Exploitation likelihood is modest in absolute terms (EPSS 0.245%, though that still ranks in the 84th percentile of all scored CVEs), there is no CISA KEV listing, no public PoC, and no Nuclei template, so this reads as a patch-management item rather than an active threat today. Real-world exposure hinges on whether any of these AI images expose a network-facing service that accepts attacker-influenced SVC encoder parameters, such as a multimodal media ingestion or transcoding path. Action: track Red Hat's RHSA-2026:30814 and the upstream fix (aomedia commit a93ba0ffaa), rebuild or pull patched base images for any RHAII/RHAIIS/RHOAI/vLLM deployment that touches video encoding, and in the interim validate or disable SVC layer configuration on any exposed encoding endpoint.

No confirmed active exploitation of CVE-2026-56210 has been reported, but organizations should still patch proactively.

Patch: track Red Hat's RHSA-2026:30814 and pull rebuilt RHAII/RHAIIS/RHOAI/vLLM base images once Red Hat ships the fix; upstream, the flaw is fixed at aomedia commit a93ba0ffaa in the aom repository. Apply vendor updates to Firefox/Thunderbird on any workstation that opens untrusted web/media content. If immediate rebuilds aren't feasible, validate spatial_layer_id against the configured number of SVC layers at the application layer before it reaches libaom, or disable SVC encoding entirely on any network-facing encoding service that doesn't need it. Run video encoding/transcoding workers in isolated, resource-limited processes (separate from inference serving processes) so a crash or heap leak in the codec path doesn't take down or expose the model-serving process itself. Detection: monitor encoding worker processes for unexpected segfaults/crashes correlated with unusual SVC layer configuration values in request logs.

This vulnerability affects the following AI/ML architecture patterns: model serving, multimodal inference pipelines, container/base-image supply chain, training data pipelines.

CVE-2026-56210 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.29%.