CVE-2026-56209 Details

A vulnerability allowing arbitrary address writes has been identified in libaom, the reference AV1 codec implementation. This issue arises from a missing bounds check in the Scalable Video Coding (SVC) layer ID control function. An attacker can exploit this vulnerability by injecting a pointer into the cyclic refresh map field using crafted image pixel values. The encoder then writes approximately 1,200 bytes to the attacker-controlled address. This exploitation is deterministic and does not require an information leak. An attacker who can send frames to a network-facing libaom encoder with SVC enabled could use this vulnerability to cause a denial-of-service or potentially execute code.

Users can update libaom to version 3.14.0 or later, where this vulnerability has been fixed. For Red Hat products, this update is available through the standard update channels. If libaom is used as a standalone encoder library, it is recommended to validate SVC layer ID parameters before use and to restrict access to encoding services from untrusted clients.