libaom EUVD-2026-38044

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

All versions of libaom (the AOMedia AV1 reference codec) prior to the upstream fix at commit a93ba0ffaa are affected when used as an encoder with SVC enabled; no specific fixed release tag is enumerated in the provided data, and exact CPE entries were not included in the references. Downstream consumers tracked through the supplied references include Red Hat (advisory https://access.redhat.com/security/cve/CVE-2026-56209 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2490800) and Chromium (https://issues.chromium.org/issues/503993984), which embeds libaom for AV1 encode in WebRTC and capture pipelines. Operators should also audit Firefox, Android media stacks, FFmpeg/GStreamer builds linked against libaom, and any WebRTC/SFU service that performs AV1 encoding of received frames.