Description
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.3 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 for RHEL 9 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat AI Inference Server | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aom | 3.14.1-1 | — |
| Debian 13 | aom | 3.12.1-1+deb13u1 | — |
| Debian 12 | aom | 3.6.0-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | aom | 3.13.1-2ubuntu0.1 | USN-8772-1 |
| Ubuntu 25.10 | aom | No fix yet | — |
| Ubuntu 24.04 LTS | aom | 3.8.2-2ubuntu0.2 | USN-8772-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | aom | 3.3.0-1ubuntu0.1+esm1 | USN-8772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | firefox +1 | 140.13.0-1.el9_8 | RHSA-2026:47104 |
| RHEL 8 | firefox | 140.13.0-1.el8_10 | RHSA-2026:47105 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | firefox | 140.13.0-1.el10_0 | RHSA-2026:54181 |
| RHEL 9.6 EUS | firefox +1 | 140.13.0-1.el9_6 | RHSA-2026:54249 |
| RHEL 9.4 E4S | firefox +1 | 140.13.0-1.el9_4 | RHSA-2026:54182 |
| RHEL 9.2 E4S | firefox +1 | 140.13.0-1.el9_2 | RHSA-2026:54185 |
| RHEL 8.8 TUS | firefox | 140.13.0-1.el8_8 | RHSA-2026:54339 |
| RHEL 8.8 E4S | firefox | 140.13.0-1.el8_8 | RHSA-2026:54339 |
| RHEL 8.6 EUS Long Life | firefox | 140.13.0-1.el8_6 | RHSA-2026:54259 |
| RHEL 8.6 AUS | firefox | 140.13.0-1.el8_6 | RHSA-2026:54259 |
| RHEL 8.4 EUS Long Life | firefox | 140.13.0-1.el8_4 | RHSA-2026:54180 |
| RHEL 8.4 AUS | firefox | 140.13.0-1.el8_4 | RHSA-2026:54180 |
| RHEL 7 ELS | firefox | 140.13.0-1.el7_9 | RHSA-2026:54248 |
| Red Hat Hardened Images 1 | aom +3 | 3.14.0-0.1.hum1 | RHSA-2026:30814 |
| Red Hat Enterprise Linux Ai 3 | aom +3 | 3.14.0-1.el9ai | RHSA-2026:51146, RHSA-2026:51100, RHSA-2026:42875 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | firefox +1 | 140.13.0-1.el9_8.alma.1 | ALSA-2026:47104 |
| AlmaLinux 8 | firefox | 140.13.0-1.el8_10.alma.1 | ALSA-2026:47105 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | firefox | 140.13.0-1.el9_8 | RLSA-2026:47104 |
| Rocky Linux 8 | firefox | 140.13.0-1.el8_10 | RLSA-2026:47105 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLES for SAP 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES for SAP 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLE HPC 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLE HPC 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libaom | 3.15.2-1.1 | openSUSE-SU-2026:12197-1 |
| openSUSE Leap 16.0 | libaom +1 | 3.11.0-160000.3.1 | openSUSE-SU-2026:21061-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.12.0-1.amzn2023.0.1 | ALAS2023-2026-1928 |
| Amazon Linux 2 | thunderbird | 140.12.0-1.amzn2.0.1 | ALAS2-2026-3795 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | firefox +1 | 140.13.0-1.0.1.el9_8 | ELSA-2026-47104 |
| Oracle Linux 8 | firefox | 140.13.0-1.0.1.el8_10 | ELSA-2026-47105 |
| Oracle Linux 7 | firefox | 140.13.0-1.0.1.el7_9 | ELSA-2026-54248 |
Advisories 30
- WID-SEC-2026-2693 Red Hat Enterprise Linux AI (libaom): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:47104 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:47105 Important: firefox security update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:12197-1 aom-tools-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
- RHSA-2026:54339 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54259 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54249 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54248 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54185 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54181 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54182 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54180 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51146 Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51100 Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:47105 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:47104 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42875 Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:30814 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-54248 Important: firefox security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 21, 2026
- USN-8772-1 aom vulnerabilities Ubuntu Security Notices (USN) · Sep 16, 2026
- RLSA-2026:47104 Important: firefox security update Rocky Linux Security Advisories · Aug 3, 2026
- RLSA-2026:47105 Important: firefox security update Rocky Linux Security Advisories · Jul 29, 2026
- ELSA-2026-47104 Important: firefox security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 29, 2026
- ELSA-2026-47105 Important: firefox security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 28, 2026
- SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3 SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:2829-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 10, 2026
- ALAS2-2026-3795 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ALAS2023-2026-1928 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- SUSE-SU-2026:22369-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21061-1 Security update for libaom SUSE / openSUSE Security Updates · Jun 30, 2026
References
- RHSA-2026:30814 vendor-advisory
- RHSA-2026:42875 vendor-advisory
- RHSA-2026:47104 vendor-advisory
- RHSA-2026:47105 vendor-advisory
- RHSA-2026:51100 vendor-advisory
- RHSA-2026:51146 vendor-advisory
- RHSA-2026:54180 vendor-advisory
- RHSA-2026:54181 vendor-advisory
- RHSA-2026:54182 vendor-advisory
- RHSA-2026:54185 vendor-advisory
- RHSA-2026:54248 vendor-advisory
- RHSA-2026:54249 vendor-advisory
- RHSA-2026:54259 vendor-advisory
- RHSA-2026:54339 vendor-advisory
- RHSA-2026:60520 vendor-advisory
- RHSA-2026:61627 vendor-advisory
- RHSA-2026:61628 vendor-advisory
- RHSA-2026:61629 vendor-advisory
- RHSA-2026:68634 vendor-advisory
- RHSA-2026:68637 vendor-advisory
- RHSA-2026:68638 vendor-advisory
- RHSA-2026:68639 vendor-advisory
- RHSA-2026:68640 vendor-advisory
- RHSA-2026:68696 vendor-advisory
- RHSA-2026:68697 vendor-advisory
- RHSA-2026:68698 vendor-advisory
- RHSA-2026:68699 vendor-advisory
- RHSA-2026:68708 vendor-advisory
- RHSA-2026:68709 vendor-advisory
- RHSA-2026:68710 vendor-advisory
- RHSA-2026:69927 vendor-advisory
- RHSA-2026:69929 vendor-advisory
- RHSA-2026:69930 vendor-advisory
- RHSA-2026:69931 vendor-advisory
- RHSA-2026:69932 vendor-advisory
- RHSA-2026:69933 vendor-advisory
- RHSA-2026:69934 vendor-advisory
- RHSA-2026:69935 vendor-advisory
- RHSA-2026:71392 vendor-advisory
- RHSA-2026:71393 vendor-advisory
- RHSA-2026:71394 vendor-advisory
- RHSA-2026:71395 vendor-advisory
- RHSA-2026:71396 vendor-advisory
- RHSA-2026:71397 vendor-advisory
- RHSA-2026:71398 vendor-advisory
- RHSA-2026:71399 vendor-advisory
- RHSA-2026:71401 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76041 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:76043 vendor-advisory
- RHSA-2026:84734 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-56208 vdb-entry
- https://aomedia.googlesource.com/aom/+/243f8ae84b