CVE-2026-56211 Details

A remote code execution vulnerability exists in libaom, the reference AV1 codec implementation, due to inadequate bounds validation in the encoder's Scalable Video Coding (SVC) layer ID control. This flaw allows an attacker to manipulate video frame pixels, causing them to overlap with critical internal encoder context structures. In services that process video in forks, this can lead to hijacking of the cyclic refresh map pointer, exploitation of a crash oracle to brute-force the process base address, and redirection of control flow for arbitrary command execution. The vulnerability affects libaom versions prior to 3.14.0, with the exploit demonstrated on version 3.13.3.

Update libaom to version 3.14.0 or later. If using libaom in a fork-based service, validate SVC layer parameters against configured bounds before passing them to the encoder API. Consider using thread-based or container-isolated workers for services that accept untrusted input, and restrict access to encoding services to trusted clients only.