CVE-2026-56208 Details

A heap buffer overflow vulnerability has been identified in libaom, the reference AV1 codec implementation. The issue arises in the AV1 encoder's Look-Ahead Processing (LAP) mode, specifically when the 'g_lag_in_frames' parameter is set to 1 or higher. This configuration bypasses the wrap-around guard for the first-pass statistics ring buffer, leading to a 232-byte out-of-bounds write on every encoded frame after the second. The overflow corrupts adjacent heap objects, and an attacker who can influence encoder settings in a transcoding service or WebRTC session could exploit this vulnerability, potentially causing a process crash or arbitrary code execution.

Users can update to libaom version 3.14.0 or later, which includes the patch for this vulnerability. For applications on RHEL-AI 3.4 and Hummingbird 1 that use the standalone libaom package, it is recommended to restrict access to the encoding service to trusted clients only and apply network-level access controls to limit who can submit video for encoding.