Every CVE Search/ Get API key

CVE-2026-56208

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

7.6 HighFix available

CVE-2026-56208 is a high vulnerability (CVSS 7.6) in Red Hat Ai Inference Server, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in firefox 140.13.0-1.el9_8.alma.1.

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
High

Exploit likelihood

0.62%Up 0.4 points since Jun 23, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.6

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
CVE-2026-56208
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122, CWE-122
Updated
2026-11-02
EUVDEUVD-2026-38045 7.6

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
EUVD-2026-38045
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mgv2-4j37-m3x6 7.6

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation....

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
GHSA-mgv2-4j37-m3x6
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
NVD 7.6

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
CVE-2026-56208
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVDEBIAN-CVE-2026-56208 7.6

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
DEBIAN-CVE-2026-56208
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:30814 7.6

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:30814
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
Show 28 moreShow less
OSVRHSA-2026:42875 7.6

Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom

Record
RHSA-2026:42875
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:47104 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:47104
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:47105 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:47105
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:51100 7.6

Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom

Record
RHSA-2026:51100
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:51146 7.6

Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom

Record
RHSA-2026:51146
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVRHSA-2026:54180 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54180
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54181 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54181
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54182 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54182
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54185 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54185
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54248 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54248
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54249 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54249
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54259 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54259
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:54339 8.8

Red Hat Security Advisory: firefox security update

Record
RHSA-2026:54339
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:47104 8.8

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47104
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:47105 8.8

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)

  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)

  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)

  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)

  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)

  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)

  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)

  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)

  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)

  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)

  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)

  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)

  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)

  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)

  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)

  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)

  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)

  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)

  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)

  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)

  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)

  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)

  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)

  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)

  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)

  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)

  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:47105
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-56208 7.6

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Record
UBUNTU-CVE-2026-56208
CVSS 3.1
7.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVALSA-2026:47104 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)
  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47104
Updated
2026-11-02
OSVALSA-2026:47105 No score

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)
  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
  • firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
  • firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
  • firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
  • firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
  • firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
  • firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
  • firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
  • firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
  • firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
  • firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
  • firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
  • firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
  • firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
  • firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
  • firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
  • firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
  • firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:47105
Updated
2026-11-02
OSVMGASA-2026-0410 No score

Updated aom packages fix security vulnerabilities

Heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. (CVE-2026-56208) Arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack. (CVE-2026-56209) Heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id. (CVE-2026-56210) Remote code execution via svc layer context handling with attacker-controlled frames. (CVE-2026-56211)

Record
MGASA-2026-0410
Updated
2026-11-02
OSVopenSUSE-SU-2026:12197-1 No score

aom-tools-3.15.2-1.1 on GA media

These are all security issues fixed in the aom-tools-3.15.2-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12197-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21061-1 No score

Security update for libaom

This update for libaom fixes the following issues

  • CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).
  • CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).
  • CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
  • CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).
Record
openSUSE-SU-2026:21061-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-56208 No score

CVE-2026-56208 in aom - Patched by Root

Root has patched CVE-2026-56208 in the aom package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-56208
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-56208 No score

CVE-2026-56208 in aom - Patched by Root

Root has patched CVE-2026-56208 in the aom package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-56208
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-56208 No score

CVE-2026-56208 in aom - Patched by Root

Root has patched CVE-2026-56208 in the aom package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-56208
Updated
2026-11-02
OSVSUSE-SU-2026:22369-1 No score

Security update for libaom

This update for libaom fixes the following issues

  • CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).
  • CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).
  • CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
  • CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).
Record
SUSE-SU-2026:22369-1
Updated
2026-11-02
OSVSUSE-SU-2026:2829-1 No score

Security update for libaom

This update for libaom fixes the following issues:

  • CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).
  • CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).
  • CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
  • CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).
Record
SUSE-SU-2026:2829-1
Updated
2026-11-02
OSVSUSE-SU-2026:3224-1 No score

Security update for SVT-AV1, libyuv0, libaom3

This update for SVT-AV1, libyuv0, libaom3 fixes the following issues:

  • CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).
  • CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).
  • CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
  • CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).

Bug fixes:

  • Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).
Record
SUSE-SU-2026:3224-1
Updated
2026-11-02
OSVUSN-8772-1 No score

aom vulnerabilities

It was discovered that AOM incorrectly handled the first-pass statistics buffer in Look-Ahead Processing (LAP) mode. An attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or possibly execute arbitrary code. (CVE-2026-56208)

It was discovered that AOM incorrectly validated spatial and temporal layer IDs in the SVC (Scalable Video Coding) encoder controls. An attacker could possibly use this issue to write to an arbitrary memory address, read out-of-bounds heap memory, or execute arbitrary code. (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211)

Record
USN-8772-1
Updated
2026-11-02

Affected products

Show 14 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
firefox
AlmaLinux:9
 before 140.13.0-1.el9_8.alma.1
140.13.0-1.el9_8.alma.1
firefox-x11
AlmaLinux:9
 before 140.13.0-1.el9_8.alma.1
140.13.0-1.el9_8.alma.1
firefox
AlmaLinux:8
 before 140.13.0-1.el8_10.alma.1
140.13.0-1.el8_10.alma.1
aom
Debian:12
 before 3.6.0-1+deb12u3, plus listed versions
3.6.0-13.6.0-1+deb12u13.6.0-1+deb12u2
3.6.0-1+deb12u3
aom
Debian:13
 before 3.12.1-1+deb13u1, plus listed versions
3.12.1-1
3.12.1-1+deb13u1
aom
Debian:14
 before 3.14.1-1, plus listed versions
3.12.1-13.13.1-13.13.1-1~exp13.13.1-2
3.14.1-1
aom
Mageia:10
 before 3.13.1-1.1.mga10
3.13.1-1.1.mga10
aom
Mageia:9
 before 3.6.0-1.2.mga9
3.6.0-1.2.mga9
aom
Red Hat:hummingbird:1
 before 0:3.14.0-0.1.hum1
0:3.14.0-0.1.hum1
libaom
Red Hat:hummingbird:1
 before 0:3.14.0-0.1.hum1
0:3.14.0-0.1.hum1
Show 109 moreShow less
Affected packages
PackageAffectedFixed
libaom-devel
Red Hat:hummingbird:1
 before 0:3.14.0-0.1.hum1
0:3.14.0-0.1.hum1
libaom-devel-docs
Red Hat:hummingbird:1
 before 0:3.14.0-0.1.hum1
0:3.14.0-0.1.hum1
aom
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debuginfo
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debugsource
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-debuginfo
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel-docs
Red Hat:enterprise_linux_ai:3.5::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
firefox
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
firefox-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
firefox-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
firefox-x11
Red Hat:enterprise_linux:9::appstream
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
firefox
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
firefox-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
firefox-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
aom
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debuginfo
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debugsource
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-debuginfo
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel-docs
Red Hat:enterprise_linux_ai:3.3::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debuginfo
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
aom-debugsource
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-debuginfo
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
libaom-devel-docs
Red Hat:enterprise_linux_ai:3.4::el9
 before 0:3.14.0-1.el9ai
0:3.14.0-1.el9ai
firefox
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:140.13.0-1.el8_4
0:140.13.0-1.el8_4
firefox
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
firefox-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
firefox-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:140.13.0-1.el10_0
0:140.13.0-1.el10_0
firefox
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
firefox-debuginfo
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
firefox-debugsource
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
firefox-x11
Red Hat:rhel_e4s:9.4::appstream
 before 0:140.13.0-1.el9_4
0:140.13.0-1.el9_4
firefox
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
firefox-debuginfo
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
firefox-debugsource
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
firefox-x11
Red Hat:rhel_e4s:9.2::appstream
 before 0:140.13.0-1.el9_2
0:140.13.0-1.el9_2
firefox
Red Hat:rhel_els:7
 before 0:140.13.0-1.el7_9
0:140.13.0-1.el7_9
firefox-debuginfo
Red Hat:rhel_els:7
 before 0:140.13.0-1.el7_9
0:140.13.0-1.el7_9
firefox
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
firefox-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
firefox-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
firefox-x11
Red Hat:rhel_eus:9.6::appstream
 before 0:140.13.0-1.el9_6
0:140.13.0-1.el9_6
firefox
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox-debuginfo
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox-debugsource
Red Hat:rhel_eus_long_life:8.6::appstream
 before 0:140.13.0-1.el8_6
0:140.13.0-1.el8_6
firefox
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox-debuginfo
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox-debugsource
Red Hat:rhel_e4s:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox-debuginfo
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox-debugsource
Red Hat:rhel_tus:8.8::appstream
 before 0:140.13.0-1.el8_8
0:140.13.0-1.el8_8
firefox
Rocky Linux:9
 before 0:140.13.0-1.el9_8
0:140.13.0-1.el9_8
firefox
Rocky Linux:8
 before 0:140.13.0-1.el8_10
0:140.13.0-1.el8_10
aom
Root:Debian:11
 before 1.0.0.errata1-3+deb11u2.root.io.9
1.0.0.errata1-3+deb11u2.root.io.91.0.0.errata1-3+deb11u2.aikido.101.0.0.errata1-3+deb11u2.root.io.8
rootio-aom
Root:Debian:11
 before 1.0.0.errata1-3+deb11u2.root.io.9
1.0.0.errata1-3+deb11u2.root.io.91.0.0.errata1-3+deb11u2.aikido.101.0.0.errata1-3+deb11u2.root.io.8
libaom
SUSE:Linux Enterprise Server 16.0
 before 3.11.0-160000.3.1
3.11.0-160000.3.1
libaom
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.11.0-160000.3.1
3.11.0-160000.3.1
libaom
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
libaom-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3.7.1-150400.3.12.1
3.7.1-150400.3.12.1
SVT-AV1
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.8.0-150600.3.2.5
1.8.0-150600.3.2.5
libaom
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 3.7.1-150600.3.9.1
3.7.1-150600.3.9.1
libyuv
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 20230517+a377993-150600.3.4.2
20230517+a377993-150600.3.4.2
SVT-AV1
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 1.8.0-150600.3.2.5
1.8.0-150600.3.2.5
libaom
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 3.7.1-150600.3.9.1
3.7.1-150600.3.9.1
libaom-devel-doc
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 3.7.1-150600.3.9.3
3.7.1-150600.3.9.3
libyuv
SUSE:Linux Enterprise Module for Desktop Applications 15 SP7
 before 20230517+a377993-150600.3.4.2
20230517+a377993-150600.3.4.2
SVT-AV1
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.8.0-150600.3.2.5
1.8.0-150600.3.2.5
libaom
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 3.7.1-150600.3.9.1
3.7.1-150600.3.9.1
libaom-devel-doc
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 3.7.1-150600.3.9.3
3.7.1-150600.3.9.3
libyuv
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 20230517+a377993-150600.3.4.2
20230517+a377993-150600.3.4.2
SVT-AV1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.8.0-150600.3.2.5
1.8.0-150600.3.2.5
libaom
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 3.7.1-150600.3.9.1
3.7.1-150600.3.9.1
libaom-devel-doc
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 3.7.1-150600.3.9.3
3.7.1-150600.3.9.3
libyuv
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 20230517+a377993-150600.3.4.2
20230517+a377993-150600.3.4.2
aom
Ubuntu:Pro:22.04:LTS
 before 3.3.0-1ubuntu0.1+esm1, plus listed versions
1.0.0.errata1-3build13.2.0-23.3.0-13.3.0-1ubuntu0.1
3.3.0-1ubuntu0.1+esm1
aom
Ubuntu:24.04:LTS
 before 3.8.2-2ubuntu0.2, plus listed versions
3.6.1-13.7.0-13.7.1-13.8.1-13.8.2-2build13.8.2-2ubuntu0.1
3.8.2-2ubuntu0.2
aom
Ubuntu:25.10
 All versions, plus listed versions
3.12.0-13.12.1-1
 None known
aom
Ubuntu:26.04:LTS
 before 3.13.1-2ubuntu0.1, plus listed versions
3.12.1-13.13.1-2
3.13.1-2ubuntu0.1
libaom
openSUSE:Tumbleweed
 before 3.15.2-1.1
3.15.2-1.1
libaom
openSUSE:Leap 16.0
 before 3.11.0-160000.3.1
3.11.0-160000.3.1
libaom-devel-doc
openSUSE:Leap 16.0
 before 3.11.0-160000.3.1
3.11.0-160000.3.1

History

History
WhenChangedSources
2026-11-03affected
2026-11-02affected, aliases, references
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 94 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open