Description
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux AI 3.3 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 for RHEL 9 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat AI Inference Server | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aom | 3.14.1-1 | — |
| Debian 13 | aom | 3.12.1-1+deb13u1 | — |
| Debian 12 | aom | 3.6.0-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | aom | 3.13.1-2ubuntu0.1 | USN-8772-1 |
| Ubuntu 25.10 | aom | No fix yet | — |
| Ubuntu 24.04 LTS | aom | 3.8.2-2ubuntu0.2 | USN-8772-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | aom | 3.3.0-1ubuntu0.1+esm1 | USN-8772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | aom +3 | 3.14.0-0.1.hum1 | RHSA-2026:30814 |
| Red Hat Enterprise Linux Ai 3 | aom +3 | 3.14.0-1.el9ai | RHSA-2026:51146, RHSA-2026:51100, RHSA-2026:42875 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLES for SAP 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES for SAP 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLE HPC 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLE HPC 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libaom | 3.15.2-1.1 | openSUSE-SU-2026:12197-1 |
| openSUSE Leap 16.0 | libaom +1 | 3.11.0-160000.3.1 | openSUSE-SU-2026:21061-1 |
Advisories 11
- WID-SEC-2026-2693 Red Hat Enterprise Linux AI (libaom): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- openSUSE-SU-2026:12197-1 aom-tools-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
- RHSA-2026:51146 Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51100 Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42875 Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:30814 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- USN-8772-1 aom vulnerabilities Ubuntu Security Notices (USN) · Sep 16, 2026
- SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3 SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:2829-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 10, 2026
- SUSE-SU-2026:22369-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21061-1 Security update for libaom SUSE / openSUSE Security Updates · Jun 30, 2026
References
- RHSA-2026:30814 vendor-advisory
- RHSA-2026:42875 vendor-advisory
- RHSA-2026:51100 vendor-advisory
- RHSA-2026:51146 vendor-advisory
- RHSA-2026:60520 vendor-advisory
- RHSA-2026:61627 vendor-advisory
- RHSA-2026:61628 vendor-advisory
- RHSA-2026:61629 vendor-advisory
- RHSA-2026:68634 vendor-advisory
- RHSA-2026:68637 vendor-advisory
- RHSA-2026:68638 vendor-advisory
- RHSA-2026:68639 vendor-advisory
- RHSA-2026:68640 vendor-advisory
- RHSA-2026:68696 vendor-advisory
- RHSA-2026:68697 vendor-advisory
- RHSA-2026:68698 vendor-advisory
- RHSA-2026:68699 vendor-advisory
- RHSA-2026:68708 vendor-advisory
- RHSA-2026:68709 vendor-advisory
- RHSA-2026:68710 vendor-advisory
- RHSA-2026:69927 vendor-advisory
- RHSA-2026:69929 vendor-advisory
- RHSA-2026:69930 vendor-advisory
- RHSA-2026:69931 vendor-advisory
- RHSA-2026:69932 vendor-advisory
- RHSA-2026:69933 vendor-advisory
- RHSA-2026:69934 vendor-advisory
- RHSA-2026:69935 vendor-advisory
- RHSA-2026:71392 vendor-advisory
- RHSA-2026:71393 vendor-advisory
- RHSA-2026:71394 vendor-advisory
- RHSA-2026:71395 vendor-advisory
- RHSA-2026:71396 vendor-advisory
- RHSA-2026:71397 vendor-advisory
- RHSA-2026:71398 vendor-advisory
- RHSA-2026:71399 vendor-advisory
- RHSA-2026:71401 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76041 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:76043 vendor-advisory
- RHSA-2026:84734 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-56209 vdb-entry
- https://aomedia.googlesource.com/aom/+/a93ba0ffaa
- RHBZ#2490800 issue-tracking
- https://issues.chromium.org/issues/503993984