Skip to main content

libaom EUVDEUVD-2026-38046

| CVE-2026-56210 HIGH
Out-of-bounds Read (CWE-125)
2026-06-19 secalert@redhat.com GHSA-xpjh-7q9g-cgj5
Buffer Overflow Denial Of Service Information Disclosure
7.1
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
vuln.today AI
7.1 HIGH

Network-reachable encoder parameter with no auth but requires a submitted stream (UI:R); bounded heap leak gives C:L, process crash gives A:H, no integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.1 HIGH
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Updated
Jun 19, 2026 - 18:59 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 19, 2026 - 18:59 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jun 19, 2026 - 18:52 vuln.today
cvss_changed
CVSS changed
Jun 19, 2026 - 18:52 NVD
8.2 (HIGH) 7.1 (HIGH)
Analysis Generated
Jun 19, 2026 - 17:33 vuln.today

DescriptionCVE.org

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

AnalysisAI

Out-of-bounds heap read in libaom's SVC layer ID control function allows remote attackers to leak approximately 40,728 bytes of heap memory or crash AV1 encoder processes by supplying a spatial_layer_id value exceeding the configured number of scalable video coding layers. The flaw affects network-facing services that pass attacker-influenced SVC encoder parameters into the reference AV1 codec, enabling information disclosure or denial of service. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

libaom is the reference encoder/decoder implementation of the AV1 video codec maintained by the Alliance for Open Media and embedded in browsers (Chromium), media servers, and WebRTC stacks. The root cause is CWE-125 (Out-of-bounds Read): the SVC layer ID control function omits a bounds check before indexing a per-layer context array, so a spatial_layer_id larger than the configured layer count drives the index calculation past the array end and reads ~40,728 bytes of adjacent heap memory. SVC is the multi-resolution/temporal layering feature used for adaptive streaming and real-time conferencing, which is precisely where untrusted clients can influence encoder configuration. The upstream fix is visible in the aomedia gitiles commit a93ba0ffaa, with Chromium tracking issue 503975732 and Red Hat Bugzilla 2490801 corroborating the same defect.

Affected ProductsAI

libaom, the Alliance for Open Media reference AV1 codec implementation, is affected in the SVC layer ID control path; exact vulnerable version ranges are not enumerated in the provided NVD CPE data. Downstream consumers tracked in the references include Chromium (issues.chromium.org/issues/503975732) and Red Hat Enterprise Linux packages of libaom (Bugzilla 2490801, advisory at access.redhat.com/security/cve/CVE-2026-56210). The upstream fix commit is at aomedia.googlesource.com/aom/+/a93ba0ffaa, which should be used to identify the first patched libaom tag once a release is cut.

RemediationAI

Upstream fix available (commit a93ba0ffaa on aomedia.googlesource.com); released patched libaom version not independently confirmed from the supplied data, so consumers should track the next libaom point release or pick up the patched package from their distribution (see access.redhat.com/security/cve/CVE-2026-56210 and Red Hat Bugzilla 2490801 for RHEL builds, and the Chromium issue 503975732 for browser-channel uptake). Until a packaged release is in place, applications that embed libaom should sanitize any externally supplied SVC parameters by clamping spatial_layer_id to the configured number of spatial layers before passing it to the encoder control, which fully neutralizes the bug without functional loss. Operators of WebRTC SFUs, transcoding services, and media gateways that do not need SVC can disable scalable video coding in their AV1 encoder configuration as a stronger workaround, at the cost of losing layered/adaptive streaming for AV1 sessions.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

EUVD-2026-38046 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy