Description
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux AI 3.3 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.4 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.5 for RHEL 9 | — | — |
| Red Hat | Red Hat AI Inference Server 3.2 | — | — |
| Red Hat | Red Hat AI Inference Server 3.3 | — | — |
| Red Hat | Red Hat Enterprise Linux AI 3.3 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI 3.3 | — | — |
| Red Hat | Red Hat OpenShift AI 3.4 | — | — |
| Red Hat | Red Hat OpenShift AI 3.5 | — | — |
| Red Hat | Red Hat AI Inference Server | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | aom | 3.14.1-1 | — |
| Debian 13 | aom | 3.12.1-1+deb13u1 | — |
| Debian 12 | aom | 3.6.0-1+deb12u3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | aom | 3.13.1-2ubuntu0.1 | USN-8772-1 |
| Ubuntu 25.10 | aom | No fix yet | — |
| Ubuntu 24.04 LTS | aom | 3.8.2-2ubuntu0.2 | USN-8772-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | aom | 3.3.0-1ubuntu0.1+esm1 | USN-8772-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | aom +3 | 3.14.0-0.1.hum1 | RHSA-2026:30814 |
| Red Hat Enterprise Linux Ai 3 | aom +3 | 3.14.0-1.el9ai | RHSA-2026:51146, RHSA-2026:51100, RHSA-2026:42875 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP7 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLES for SAP 15 SP6 | SVT-AV1 | 1.8.0-150600.3.2.5 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom | 3.7.1-150600.3.9.1 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libaom-devel-doc | 3.7.1-150600.3.9.3 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP6 | libyuv | 20230517+a377993-150600.3.4.2 | SUSE-SU-2026:3224-1 |
| SLES for SAP 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES for SAP 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLES 16.0 | libaom | 3.11.0-160000.3.1 | SUSE-SU-2026:22369-1 |
| SLE HPC 15 SP5 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
| SLE HPC 15 SP4 | libaom +1 | 3.7.1-150400.3.12.1 | SUSE-SU-2026:2829-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libaom | 3.15.2-1.1 | openSUSE-SU-2026:12197-1 |
| openSUSE Leap 16.0 | libaom +1 | 3.11.0-160000.3.1 | openSUSE-SU-2026:21061-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | firefox | 140.12.0-1.amzn2023.0.1 | ALAS2023-2026-1928 |
| Amazon Linux 2 | thunderbird | 140.12.0-1.amzn2.0.1 | ALAS2-2026-3795 |
Advisories 13
- WID-SEC-2026-2693 Red Hat Enterprise Linux AI (libaom): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2026
- openSUSE-SU-2026:12197-1 aom-tools-3.15.2-1.1 on GA media SUSE / openSUSE Security Updates · Oct 21, 2026
- RHSA-2026:51146 Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:51100 Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42875 Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:30814 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- USN-8772-1 aom vulnerabilities Ubuntu Security Notices (USN) · Sep 16, 2026
- SUSE-SU-2026:3224-1 Security update for SVT-AV1, libyuv0, libaom3 SUSE / openSUSE Security Updates · Jul 24, 2026
- SUSE-SU-2026:2829-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 10, 2026
- ALAS2-2026-3795 Important: thunderbird security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- ALAS2023-2026-1928 Important: firefox security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
- SUSE-SU-2026:22369-1 Security update for libaom SUSE / openSUSE Security Updates · Jul 2, 2026
- openSUSE-SU-2026:21061-1 Security update for libaom SUSE / openSUSE Security Updates · Jun 30, 2026
References
- RHSA-2026:30814 vendor-advisory
- RHSA-2026:42875 vendor-advisory
- RHSA-2026:51100 vendor-advisory
- RHSA-2026:51146 vendor-advisory
- RHSA-2026:60520 vendor-advisory
- RHSA-2026:61627 vendor-advisory
- RHSA-2026:61628 vendor-advisory
- RHSA-2026:61629 vendor-advisory
- RHSA-2026:68634 vendor-advisory
- RHSA-2026:68637 vendor-advisory
- RHSA-2026:68638 vendor-advisory
- RHSA-2026:68639 vendor-advisory
- RHSA-2026:68640 vendor-advisory
- RHSA-2026:68696 vendor-advisory
- RHSA-2026:68697 vendor-advisory
- RHSA-2026:68698 vendor-advisory
- RHSA-2026:68699 vendor-advisory
- RHSA-2026:68708 vendor-advisory
- RHSA-2026:68709 vendor-advisory
- RHSA-2026:68710 vendor-advisory
- RHSA-2026:69927 vendor-advisory
- RHSA-2026:69929 vendor-advisory
- RHSA-2026:69930 vendor-advisory
- RHSA-2026:69931 vendor-advisory
- RHSA-2026:69932 vendor-advisory
- RHSA-2026:69933 vendor-advisory
- RHSA-2026:69934 vendor-advisory
- RHSA-2026:69935 vendor-advisory
- RHSA-2026:71392 vendor-advisory
- RHSA-2026:71393 vendor-advisory
- RHSA-2026:71394 vendor-advisory
- RHSA-2026:71395 vendor-advisory
- RHSA-2026:71396 vendor-advisory
- RHSA-2026:71397 vendor-advisory
- RHSA-2026:71398 vendor-advisory
- RHSA-2026:71399 vendor-advisory
- RHSA-2026:71401 vendor-advisory
- RHSA-2026:74771 vendor-advisory
- RHSA-2026:75652 vendor-advisory
- RHSA-2026:75654 vendor-advisory
- RHSA-2026:75657 vendor-advisory
- RHSA-2026:75658 vendor-advisory
- RHSA-2026:75659 vendor-advisory
- RHSA-2026:75660 vendor-advisory
- RHSA-2026:76041 vendor-advisory
- RHSA-2026:76042 vendor-advisory
- RHSA-2026:76043 vendor-advisory
- RHSA-2026:84734 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-56211 vdb-entry
- https://aomedia.googlesource.com/aom/+/a93ba0ffaa
- RHBZ#2490802 issue-tracking
- https://issues.chromium.org/issues/503993985