A flaw in libaom’s handling of the SVC layer ID allows an attacker to supply crafted video frame pixels that overlap with internal encoder context structures. This overlap can hijack the cyclic refresh map pointer, allowing an attacker to brute‑force the process base address via a crash oracle and redirect the encoder’s control flow to execute arbitrary code. The vulnerability can lead to full remote code execution on the host running the vulnerable encoder.

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux AI 3, and Red Hat Hardened Images are affected. No specific impacted versions are listed in the CVE data, so all current releases that use libaom with SVC encoding may be vulnerable.

The CVSS score of 7.1 indicates a high impact risk. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw’s exploitation requires an attacker to send maliciously crafted frames to a service that uses libaom SVC encoding. The likely vector is a remote network‑based video processing service that accepts untrusted input. Because the attack requires only the ability to supply frames, it can be performed from an unprivileged remote host, making it a significant threat for exposed encoding services.