{"id":"CVE-2026-56211","aliases":["DEBIAN-CVE-2026-56211","EUVD-2026-38047","GHSA-qr4p-j2pf-4w4x","MGASA-2026-0410","OESA-2026-2864","OESA-2026-2865","OESA-2026-2866","OESA-2026-2867","OESA-2026-3601","RHSA-2026:30814","RHSA-2026:42875","RHSA-2026:51100","RHSA-2026:51146","ROOT-OS-DEBIAN-11-CVE-2026-56211","ROOT-OS-DEBIAN-12-CVE-2026-56211","ROOT-OS-DEBIAN-13-CVE-2026-56211","SUSE-SU-2026:22369-1","SUSE-SU-2026:2829-1","SUSE-SU-2026:3224-1","UBUNTU-CVE-2026-56211","USN-8772-1","openSUSE-SU-2026:12197-1","openSUSE-SU-2026:21061-1"],"status":"published","title":"Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00876,"percentile":0.59439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-06-19T16:28:33Z","modified":"2026-11-05T09:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"aom","fixed_in":["3.6.0-1+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"aom","fixed_in":["3.12.1-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"aom","fixed_in":["3.14.1-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"aom","fixed_in":["1.0.0.errata1-3+deb11u2.root.io.9","1.0.0.errata1-3+deb11u2.aikido.10"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-aom","fixed_in":["1.0.0.errata1-3+deb11u2.root.io.9","1.0.0.errata1-3+deb11u2.aikido.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"aom","fixed_in":["3.3.0-1ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"aom","fixed_in":["3.8.2-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"aom","fixed_in":["3.13.1-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1+deb12u3"}]}],"versions":["3.6.0-1","3.6.0-1+deb12u1","3.6.0-1+deb12u2"]},{"source":"osv","ecosystem":"Debian:13","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.1-1+deb13u1"}]}],"versions":["3.12.1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-1"}]}],"versions":["3.12.1-1","3.13.1-1","3.13.1-1~exp1","3.13.1-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-1.1.mga10"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:9","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-1.2.mga9"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-3.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-6.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-6.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-5.oe2403sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libaom-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libaom-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-0.1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"aom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"aom-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libaom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libaom-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.5::el9","package":"libaom-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"aom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"aom-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"libaom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"libaom-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.3::el9","package":"libaom-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"aom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"aom-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"libaom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"libaom-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_ai:3.4::el9","package":"libaom-devel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.14.0-1.el9ai"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Debian:11","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.errata1-3+deb11u2.root.io.9"},{"fixed":"1.0.0.errata1-3+deb11u2.aikido.10"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0.errata1-3+deb11u2.root.io.9"},{"fixed":"1.0.0.errata1-3+deb11u2.aikido.10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150400.3.12.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"SVT-AV1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libyuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"SVT-AV1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"libyuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"SVT-AV1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libyuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"SVT-AV1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libyuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.1+esm1"}]}],"versions":["1.0.0.errata1-3build1","3.2.0-2","3.3.0-1","3.3.0-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-2ubuntu0.2"}]}],"versions":["3.6.1-1","3.7.0-1","3.7.1-1","3.8.1-1","3.8.2-2build1","3.8.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.0-1","3.12.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-2ubuntu0.1"}]}],"versions":["3.12.1-1","3.13.1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-1ubuntu0.1+esm1"}]}],"versions":["1.0.0.errata1-3build1","3.2.0-2","3.3.0-1","3.3.0-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-2ubuntu0.2"}]}],"versions":["3.6.1-1","3.7.0-1","3.7.1-1","3.8.1-1","3.8.2-2build1","3.8.2-2ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"aom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-2ubuntu0.1"}]}],"versions":["3.12.1-1","3.13.1-2"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libaom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-160000.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libaom-devel-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0-160000.3.1"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"red hat ai inference server"},{"vendor":"red hat","product":"red hat ai inference server 3.2"},{"vendor":"red hat","product":"red hat ai inference server 3.3"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.3"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.3 for rhel 9"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.4 for rhel 9"},{"vendor":"red hat","product":"red hat enterprise linux ai 3.5 for rhel 9"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"},{"vendor":"red hat","product":"red hat openshift ai 3.3"},{"vendor":"red hat","product":"red hat openshift ai 3.4"},{"vendor":"red hat","product":"red hat openshift ai 3.5"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30814","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42875","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51100","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51146","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68634","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68637","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68638","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68639","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68640","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68696","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68697","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68698","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68699","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68708","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68709","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:68710","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69927","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69929","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69930","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69931","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69932","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69933","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69934","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69935","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71392","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71393","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71394","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71395","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71396","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71397","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71398","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71399","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71401","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:74771","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75652","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75654","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75657","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75658","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75659","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:75660","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76041","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76042","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:76043","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:84734","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56211","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://aomedia.googlesource.com/aom/+/a93ba0ffaa","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490802","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://issues.chromium.org/issues/503993985","tags":["article","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56211.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56211","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qr4p-j2pf-4w4x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56211","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0410.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36170","tags":["report"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00322.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56209","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56210","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2865","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2866","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2867","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3601","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56208","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56209","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56210","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30814.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490799","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56208","tags":["advisory"]},{"url":"https://aomedia.googlesource.com/aom/+/243f8ae84b","tags":["article"]},{"url":"https://issues.chromium.org/issues/504317456","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490800","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56209","tags":["advisory"]},{"url":"https://issues.chromium.org/issues/503993984","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490801","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56210","tags":["advisory"]},{"url":"https://issues.chromium.org/issues/503975732","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56211","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://issues.redhat.com/browse/AIPCC-22882","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42875.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/AIPCC-29004","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51100.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/AIPCC-29003","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51146.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622369-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268650","tags":["report"]},{"url":"https://bugzilla.suse.com/1268651","tags":["report"]},{"url":"https://bugzilla.suse.com/1268653","tags":["report"]},{"url":"https://bugzilla.suse.com/1268655","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56208","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56211","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262829-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263224-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263678","tags":["report"]},{"url":"https://bugzilla.suse.com/1268242","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56211","tags":["report"]},{"url":"https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8772-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-56208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-56210","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-13906","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-56211","title":"Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T16:28:33.603Z","modified":"2026-11-04T22:51:47.929Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787","CWE-787"],"updated_at":"2026-11-04T23:40:09.798467Z"}],"euvd":[{"id":"EUVD-2026-38047","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T16:28:33Z","modified":"2026-11-04T22:51:47Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T00:47:41.139684Z"}],"ghsa":[{"id":"GHSA-qr4p-j2pf-4w4x","title":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation...","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T18:32:34Z","modified":"2026-10-19T12:32:42Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:13:56.45986Z"}],"nvd":[{"id":"CVE-2026-56211","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T17:16:30.68Z","modified":"2026-11-04T23:17:51.41Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-05T01:45:09.958441Z"}],"osv":[{"id":"DEBIAN-CVE-2026-56211","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T17:16:30.68Z","modified":"2026-11-05T09:47:29.765906511Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2026-2864","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.(CVE-2026-56209)\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).(CVE-2026-56210)\n\nA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0026apos;s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.(CVE-2026-56211)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.208631505Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2865","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.(CVE-2026-56209)\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).(CVE-2026-56210)\n\nA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0026apos;s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.(CVE-2026-56211)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:15.100990383Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2866","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.(CVE-2026-56209)\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).(CVE-2026-56210)\n\nA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0026apos;s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.(CVE-2026-56211)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.557460917Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2867","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.(CVE-2026-56209)\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).(CVE-2026-56210)\n\nA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0026apos;s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.(CVE-2026-56211)","status":"published","published":"2026-07-06T11:11:46Z","modified":"2026-08-18T01:21:14.028505148Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3601","title":"aom security update","description":"The Alliance for Open Media’s focus is to deliver a next-generation video format that is:\r\n\r\nSecurity Fix(es):\n\nAn arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.(CVE-2026-56209)\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).(CVE-2026-56210)\n\nA remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0026apos;s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.(CVE-2026-56211)","status":"published","published":"2026-09-05T15:03:02Z","modified":"2026-09-05T15:16:25.98195896Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:30814","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-06-29T11:29:38Z","modified":"2026-10-20T10:07:12Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:42875","title":"Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom","status":"published","published":"2026-07-23T10:14:15Z","modified":"2026-10-20T10:09:08Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:51100","title":"Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom","status":"published","published":"2026-08-07T10:28:40Z","modified":"2026-10-20T10:10:34Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:51146","title":"Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom","status":"published","published":"2026-08-07T10:28:42Z","modified":"2026-10-20T10:10:36Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"UBUNTU-CVE-2026-56211","description":"A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.","status":"published","published":"2026-06-19T17:16:00Z","modified":"2026-09-16T20:24:06.460219641Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"MGASA-2026-0410","title":"Updated aom packages fix security vulnerabilities","description":"Heap buffer overflow in av1 encoder first-pass stats buffer via lap\nmode. (CVE-2026-56208)\nArbitrary address write via svc layer context oob and cyclic refresh map\npointer hijack. (CVE-2026-56209)\nHeap-buffer-overflow read via missing bounds check in ctrl_set_layer_id.\n(CVE-2026-56210)\nRemote code execution via svc layer context handling with\nattacker-controlled frames. (CVE-2026-56211)\n","status":"published","published":"2026-09-16T15:40:01Z","modified":"2026-09-16T15:45:03.445339115Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12197-1","title":"aom-tools-3.15.2-1.1 on GA media","description":"These are all security issues fixed in the aom-tools-3.15.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-20T00:00:00Z","modified":"2026-10-21T17:23:13.447154016Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:21061-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues\n\n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash\n  (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write\n  (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n","status":"published","published":"2026-06-25T19:32:50Z","modified":"2026-06-30T18:24:38.455901088Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-56211","title":"CVE-2026-56211 in aom - Patched by Root","description":"Root has patched CVE-2026-56211 in the aom package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:07:36Z","modified":"2026-08-20T13:30:09.981791749Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-56211","title":"CVE-2026-56211 in aom - Patched by Root","description":"Root has patched CVE-2026-56211 in the aom package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T08:28:46Z","modified":"2026-09-14T14:00:05.493611193Z","updated_at":"2026-11-02T15:53:32.298225Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-56211","title":"CVE-2026-56211 in aom - Patched by Root","description":"Root has patched CVE-2026-56211 in the aom package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-23T14:17:04Z","modified":"2026-10-08T13:00:07.351779289Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:22369-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues\n\n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash\n  (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write\n  (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n","status":"published","published":"2026-06-25T19:33:13Z","modified":"2026-07-02T18:24:14.642125574Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2829-1","title":"Security update for libaom","description":"This update for libaom fixes the following issues:\n \n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n","status":"published","published":"2026-07-09T18:40:20Z","modified":"2026-07-10T10:00:08.943519547Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3224-1","title":"Security update for SVT-AV1, libyuv0, libaom3","description":"This update for SVT-AV1, libyuv0, libaom3 fixes the following issues:\n\n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash\n  (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write\n  (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n\nBug fixes:\n\n- Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).\n","status":"published","published":"2026-07-23T18:34:24Z","modified":"2026-07-24T17:16:07.632086048Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8772-1","title":"aom vulnerabilities","description":"It was discovered that AOM incorrectly handled the first-pass statistics\nbuffer in Look-Ahead Processing (LAP) mode. An attacker could possibly use\nthis issue to cause a heap buffer overflow, leading to a denial of service\nor possibly execute arbitrary code. (CVE-2026-56208)\n\nIt was discovered that AOM incorrectly validated spatial and temporal\nlayer IDs in the SVC (Scalable Video Coding) encoder controls. An attacker\ncould possibly use this issue to write to an arbitrary memory address, read\nout-of-bounds heap memory, or execute arbitrary code. (CVE-2026-56209,\nCVE-2026-56210, CVE-2026-56211)","status":"published","published":"2026-09-16T09:29:07Z","modified":"2026-09-16T20:27:34.125593287Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}