Description
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux AI 3.3 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 for RHEL 9 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat AI Inference Server | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aom | 3.14.1-1 | — |
| Debian 13 | aom | 3.12.1-1+deb13u1 | — |
| Debian 12 | aom | 3.6.0-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | aom | 3.13.1-2ubuntu0.1 | USN-8772-1 |
| Ubuntu 25.10 | aom | No fix yet | — |
| Ubuntu 24.04 LTS | aom | 3.8.2-2ubuntu0.2 | USN-8772-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | aom | 3.3.0-1ubuntu0.1+esm1 | USN-8772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | aom +3 | 3.14.0-0.1.hum1 | RHSA-2026:30814 |
| Red Hat Enterprise Linux Ai 3 | aom +3 | 3.14.0-1.el9ai | RHSA-2026:51146, RHSA-2026:51100, RHSA-2026:42875 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLES for SAP 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES for SAP 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLE HPC 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLE HPC 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libaom | 3.15.2-1.1 | openSUSE-SU-2026:12197-1 |
| openSUSE Leap 16.0 | libaom +1 | 3.11.0-160000.3.1 | openSUSE-SU-2026:21061-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.12.0-1.amzn2023.0.1 | ALAS2023-2026-1928 |
| Amazon Linux 2 | thunderbird | 140.12.0-1.amzn2.0.1 | ALAS2-2026-3795 |
Advisories 13
- WID-SEC-2026-2693 Red Hat Enterprise Linux AI (libaom): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- openSUSE-SU-2026:12197-1 aom-tools-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
- RHSA-2026:51146 Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51100 Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42875 Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:30814 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- USN-8772-1 aom vulnerabilities Ubuntu Security Notices (USN) · Sep 16, 2026
- SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3 SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:2829-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 10, 2026
- ALAS2-2026-3795 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ALAS2023-2026-1928 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- SUSE-SU-2026:22369-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21061-1 Security update for libaom SUSE / openSUSE Security Updates · Jun 30, 2026
References
- RHSA-2026:30814 vendor-advisory
- RHSA-2026:42875 vendor-advisory
- RHSA-2026:51100 vendor-advisory
- RHSA-2026:51146 vendor-advisory
- RHSA-2026:60520 vendor-advisory
- RHSA-2026:61627 vendor-advisory
- RHSA-2026:61628 vendor-advisory
- RHSA-2026:61629 vendor-advisory
- RHSA-2026:68634 vendor-advisory
- RHSA-2026:68637 vendor-advisory
- RHSA-2026:68638 vendor-advisory
- RHSA-2026:68639 vendor-advisory
- RHSA-2026:68640 vendor-advisory
- RHSA-2026:68696 vendor-advisory
- RHSA-2026:68697 vendor-advisory
- RHSA-2026:68698 vendor-advisory
- RHSA-2026:68699 vendor-advisory
- RHSA-2026:68708 vendor-advisory
- RHSA-2026:68709 vendor-advisory
- RHSA-2026:68710 vendor-advisory
- RHSA-2026:69927 vendor-advisory
- RHSA-2026:69929 vendor-advisory
- RHSA-2026:69930 vendor-advisory
- RHSA-2026:69931 vendor-advisory
- RHSA-2026:69932 vendor-advisory
- RHSA-2026:69933 vendor-advisory
- RHSA-2026:69934 vendor-advisory
- RHSA-2026:69935 vendor-advisory
- RHSA-2026:71392 vendor-advisory
- RHSA-2026:71393 vendor-advisory
- RHSA-2026:71394 vendor-advisory
- RHSA-2026:71395 vendor-advisory
- RHSA-2026:71396 vendor-advisory
- RHSA-2026:71397 vendor-advisory
- RHSA-2026:71398 vendor-advisory
- RHSA-2026:71399 vendor-advisory
- RHSA-2026:71401 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76041 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:76043 vendor-advisory
- RHSA-2026:84734 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-56210 vdb-entry
- https://aomedia.googlesource.com/aom/+/a93ba0ffaa
- RHBZ#2490801 issue-tracking
- https://issues.chromium.org/issues/503975732