CVE-2026-56210 Details

A heap-buffer-overflow read vulnerability has been identified in libaom, the reference AV1 codec implementation. This vulnerability arises from a missing bounds check in the Scalable Video Coding (SVC) layer ID control function, which allows the spatial_layer_id to be set beyond the configured limit. As a result, an out-of-bounds heap read of approximately 40,728 bytes occurs when the encoder computes a layer context array index. This vulnerability could be exploited by an attacker who can influence SVC encoder parameters in a network-facing service, leading to information disclosure through a heap content leak or causing a denial-of-service by triggering a segmentation fault from accessing unmapped memory.

Update libaom to version 3.14.0 or later, where this vulnerability has been fixed by adding proper bounds validation to the layer ID control functions. For Red Hat users, ensure that Firefox and Thunderbird are updated to versions that include the patched libaom.