Skip to main content

libaom EUVDEUVD-2026-38047

| CVE-2026-56211 HIGH
Out-of-bounds Write (CWE-787)
2026-06-19 secalert@redhat.com GHSA-qr4p-j2pf-4w4x
RCE Buffer Overflow Memory Corruption Oracle
7.1
CVSS 3.1 · Vendor: redhat
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify fork-based AV1 encoder accepting frames
  2. Delivery
    Submit crafted SVC-layer video frame
  3. Exploit
    Trigger OOB write into layer context
  4. Install
    Crash children to brute-force base address
  5. C2
    Overwrite cyclic refresh map pointer
  6. Execute
    Hijack control flow on next encode
  7. Impact
    Execute arbitrary commands as encoder service

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

The target service must (1) link libaom as its AV1 encoder, (2) have SVC (Scalable Video Coding) enabled on the encode path, (3) accept attacker-controlled raw video frame pixels - not just pre-encoded bitstreams routed through the decoder - and (4) be deployed in a fork-based worker model so child crashes leak address information back to the attacker for the ASLR brute force. Exploitation is further limited by CVSS AC:H (the crash-oracle brute force is non-trivial and noisy) and UI:R (an attacker must induce processing of their frame, e.g. by submitting an upload or initiating a call); pure decode-only consumers, non-SVC encoder configurations, and single-exec (non-fork) transcoders are not exploitable via this chain.
Impact

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H reflects the real shape of the bug: reachable over the network through any service that ingests user video, but requiring high attack complexity (the crash-oracle ASLR brute force and the fork-based deployment) and at least nominal user interaction (submitting a frame). No EPSS, KEV or SSVC data is provided, and there is no indication of active exploitation, so this is not a drop-everything patch in the same tier as a KEV-listed bug. However, the impact is genuine code execution in a widely embedded codec library, and a working upstream commit exists which lowers the bar for a researcher to derive an exploit - defenders running fork-model AV1 transcoders (e.g. video upload/streaming pipelines) should treat it as a high-priority patch even though raw EPSS-style telemetry is unavailable.
Exploit ScenarioDerived

An attacker uploads or streams a crafted AV1 source video to a public transcoding or video-conferencing service whose backend runs a fork-based libaom encoder with SVC enabled. The malicious pixel layout overflows into the SVC layer context, repeatedly crashing child processes to leak the encoder process's base address, and then a final frame hijacks the cyclic refresh map pointer to redirect execution and run attacker commands as the encoder service user. No public PoC is currently identified, but the upstream fix commit provides a clear root-cause reference for exploit developers.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jun 19, 2026

Remote code execution in libaom (reference AV1 codec) is possible when services use the SVC encoder with attacker-supplied frames, allowing crafted pixel data to overlap encoder layer context structures and hijack the cyclic refresh map pointer. The flaw chains a heap out-of-bounds write (CWE-787) with a crash-oracle ASLR bypass to redirect control flow in fork-based video processing services. No public exploit identified at time of analysis, but the issue is tracked under Red Hat and Chromium security trackers and an upstream fix commit has landed in aomedia.

Earlier versions of this analysis (2)
v2 Jun 19, 2026 - 18:58 cvss changed CVSS 7.1

Remote code execution in libaom (the reference AV1 codec) is possible when the AV1 encoder is built with Scalable Video Coding (SVC) enabled and accepts attacker-controlled frame data. Insufficient bounds validation in the SVC layer ID control lets crafted pixel data overwrite adjacent encoder layer context structures, including the cyclic refresh map pointer, which can be leveraged into control-flow hijack in fork-based video services. No public exploit identified at time of analysis, but the writeup discloses a concrete exploitation primitive (crash-oracle ASLR defeat plus pointer hijack).

v1 Jun 19, 2026 - 17:35 CVSS 8.1

Remote code execution in libaom's AV1 SVC encoder enables unauthenticated network attackers to achieve arbitrary command execution by supplying crafted video frames that trigger an out-of-bounds write in the SVC layer ID validation path. The flaw causes attacker-controlled pixel data to overlap with internal encoder layer context structures, specifically hijacking the cyclic refresh map pointer; in fork-based media processing services, a crash-oracle technique allows iterative brute-forcing of ASLR to complete the exploit chain. No public exploit code or CISA KEV listing exists at time of analysis, but the upstream fix commit is publicly visible on Google's AOM source repository, and the Chromium issue tracker reference suggests broader library consumer exposure.

RemediationAI

Upstream fix available (commit a93ba0ffaa); released patched version not independently confirmed - rebuild or upgrade libaom to a release that includes aomedia commit a93ba0ffaa (https://aomedia.googlesource.com/aom/+/a93ba0ffaa) and pull the corresponding distro packages once published (track Red Hat at https://access.redhat.com/security/cve/CVE-2026-56211 and Bugzilla https://bugzilla.redhat.com/show_bug.cgi?id=2490802, and Chromium at https://issues.chromium.org/issues/503993985). Until a packaged build is deployed, the most surgical workaround is to disable SVC encoding in any service that exposes libaom to untrusted video (this removes adaptive layered streaming, so multi-bitrate ABR pipelines will lose that capability); operators of fork-based transcoders should additionally re-enable per-process ASLR re-randomization or switch to a fresh-exec model so the crash-oracle brute force loses its stable base address (this costs throughput from lost fork-server warm state). Restricting upload of attacker-controlled raw frames and validating frame dimensions before passing them to libaom provides partial defense but does not address the underlying out-of-bounds write.

Affected ProductsAI

The vulnerable component is libaom, the AOMedia reference AV1 codec, specifically the AV1 encoder's SVC layer-ID control path. Exact fixed versions are not enumerated in the provided data; the upstream fix is the aomedia commit a93ba0ffaa (https://aomedia.googlesource.com/aom/+/a93ba0ffaa). Downstream tracking is available via Red Hat (https://access.redhat.com/security/cve/CVE-2026-56211 and Bugzilla 2490802 at https://bugzilla.redhat.com/show_bug.cgi?id=2490802) and Chromium issue 503993985 (https://issues.chromium.org/issues/503993985), indicating Red Hat Enterprise Linux libaom packages and Chromium/Chrome's bundled libaom are affected pending vendor-specific package versions. No CPE strings were supplied, so precise affected version ranges for distros and embedders must be confirmed against each vendor advisory.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

libaom is the Alliance for Open Media reference encoder/decoder for the AV1 video codec, used by Chromium, Android, FFmpeg, GStreamer and many cloud transcoding pipelines. The bug lives in the AV1 encoder's Scalable Video Coding (SVC) layer-ID control path, where insufficient bounds validation lets pixel data from an input frame spill into adjacent internal layer-context structures - the classic CWE-787 out-of-bounds write pattern. Because the corrupted field is the cyclic refresh map pointer (a function-table-like data pointer used during encode), an attacker who can also observe child-process crashes in a fork-server design can brute-force the base address and gain arbitrary control-flow hijack, turning a memory-safety issue into command execution.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (redhat) PRIMARY 7.1 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
vuln.today AI 7.1 HIGH

Reachable over network with no auth but needs victim-side frame processing (UI:R) and a non-trivial crash-oracle brute force plus SVC/fork preconditions (AC:H); RCE yields high I/A and limited info leak (C:L).

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat 7.1 HIGH

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Jun 19, 2026 - 18:58 vuln.today
v3 - CVSS changed
Analysis Updated
Jun 19, 2026 - 18:58 vuln.today
v2 - CVSS changed
CVSS changed
Jun 19, 2026 - 18:52 NVD
8.1 (HIGH) 7.1 (HIGH)

DescriptionCVE.org

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

Executive ViewAI

Why It Matters

AV1 codec library libaom contains a remote code execution vulnerability in its SVC encoder affecting video processing services that accept untrusted frame input. Organizations operating streaming platforms, video transcoding pipelines, or media infrastructure face potential data exposure and service disruption through malicious video submissions.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis; upstream fix available in aomedia source repository for self-compilation. Interim controls: (1) Disable SVC encoder if operationally feasible; (2) Restrict video input to authenticated/internal sources; (3) Run video processing in restricted containers with least-privilege isolation; (4) Implement rate limiting and input validation on video submission endpoints; (5) Monitor for unexpected process termination or resource anomalies.

Threat Intelligence Overview

EPSS Score
0.4%
Top 70% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8772-1 ADVISORY https://vuldb.com/vuln/372464 REF https://access.redhat.com/errata/RHSA-2026:30814 REF https://access.redhat.com/errata/RHSA-2026:42875 REF https://access.redhat.com/errata/RHSA-2026:51100 REF https://access.redhat.com/errata/RHSA-2026:51146 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:61627 REF https://access.redhat.com/errata/RHSA-2026:61628 REF https://access.redhat.com/errata/RHSA-2026:61629 REF https://access.redhat.com/errata/RHSA-2026:68634 REF https://access.redhat.com/errata/RHSA-2026:68637 REF https://access.redhat.com/errata/RHSA-2026:68638 REF https://access.redhat.com/errata/RHSA-2026:68639 REF https://access.redhat.com/errata/RHSA-2026:68640 REF https://access.redhat.com/errata/RHSA-2026:68696 REF https://access.redhat.com/errata/RHSA-2026:68697 REF https://access.redhat.com/errata/RHSA-2026:68698 REF https://access.redhat.com/errata/RHSA-2026:68699 REF https://access.redhat.com/errata/RHSA-2026:68708 REF https://access.redhat.com/errata/RHSA-2026:68709 REF https://access.redhat.com/errata/RHSA-2026:68710 REF https://access.redhat.com/errata/RHSA-2026:69927 REF https://access.redhat.com/errata/RHSA-2026:69929 REF https://access.redhat.com/errata/RHSA-2026:69930 REF https://access.redhat.com/errata/RHSA-2026:69931 REF https://access.redhat.com/errata/RHSA-2026:69932 REF https://access.redhat.com/errata/RHSA-2026:69933 REF https://access.redhat.com/errata/RHSA-2026:69934 REF https://access.redhat.com/errata/RHSA-2026:69935 REF https://access.redhat.com/errata/RHSA-2026:71392 REF https://access.redhat.com/errata/RHSA-2026:71393 REF https://access.redhat.com/errata/RHSA-2026:71394 REF https://access.redhat.com/errata/RHSA-2026:71395 REF https://access.redhat.com/errata/RHSA-2026:71396 REF https://access.redhat.com/errata/RHSA-2026:71397 REF https://access.redhat.com/errata/RHSA-2026:71398 REF https://access.redhat.com/errata/RHSA-2026:71399 REF https://access.redhat.com/errata/RHSA-2026:71401 REF https://access.redhat.com/errata/RHSA-2026:74771 REF https://access.redhat.com/errata/RHSA-2026:75652 REF https://access.redhat.com/errata/RHSA-2026:75654 REF https://access.redhat.com/errata/RHSA-2026:75657 REF https://access.redhat.com/errata/RHSA-2026:75658 REF https://access.redhat.com/errata/RHSA-2026:75659 REF https://access.redhat.com/errata/RHSA-2026:75660 REF https://access.redhat.com/errata/RHSA-2026:76041 REF https://access.redhat.com/errata/RHSA-2026:76042 REF https://access.redhat.com/errata/RHSA-2026:76043 REF https://access.redhat.com/errata/RHSA-2026:84734 REF https://access.redhat.com/security/cve/CVE-2026-56211 REF https://aomedia.googlesource.com/aom/+/a93ba0ffaa REF https://bugzilla.redhat.com/show_bug.cgi?id=2490802 REF https://issues.chromium.org/issues/503993985 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56211.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy