Skip to content
Fencer Vulns
high 7.6

CVE-2026-56208 json

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

published 2026-06-19 4 mo ago modified 2026-11-06 3 d ago also EUVD-2026-38045

cvss
7.6
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:140.13.0-1.el10_0
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:140.13.0-1.el7_9
  • Red Hat Red Hat Enterprise Linux 8 0:140.13.0-1.el8_10
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:140.13.0-1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:140.13.0-1.el8_4
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:140.13.0-1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:140.13.0-1.el8_6
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:140.13.0-1.el8_8
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:140.13.0-1.el8_8
  • Red Hat Red Hat Enterprise Linux 9 0:140.13.0-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:140.13.0-1.el9_2
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:140.13.0-1.el9_4
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:140.13.0-1.el9_6
  • Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat Enterprise Linux AI 3.4 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat Enterprise Linux AI 3.5 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat AI Inference Server 3.2 1787772157, 1787860580, 1787884873
  • Red Hat Red Hat AI Inference Server 3.3 1789502493, 1789504371, 1789508287, 1789582776
  • Red Hat Red Hat Enterprise Linux AI 3.3 1790791893, 1790850900, 1790866732, 1790936334, 1790936351, 1790954179
  • Red Hat Red Hat Hardened Images 3.14.0-0.1.hum1
  • Red Hat Red Hat OpenShift AI 3.3 1789137548, 1789137552, 1789137607, 1789137636, 1789137641
  • Red Hat Red Hat OpenShift AI 3.4 1786611800, 1787076481, 1787076778, 1787077779, 1788197530, 1788197549, 1788197632, 1788197677, 1788197680, 1788197744, 1788197747, 1788199622, 1791785804
  • Red Hat Red Hat OpenShift AI 3.5 1788197385, 1788197492, 1788197512, 1788197542, 1788197688, 1788197975, 1788198016, 1788198404, 1788198407, 1790703552, 1790703554, 1790703557, 1790703630, 1790703645, 1790703656, 1790703706
  • aom Debian 12 3.6.0-1+deb12u3
  • aom Debian 13 3.12.1-1+deb13u1
  • aom Debian 14 3.14.1-1

debian advisories DEBIAN-CVE-2026-56208

  • aom Ubuntu 24.04 LTS 3.8.2-2ubuntu0.2
  • aom Ubuntu 26.04 LTS 3.13.1-2ubuntu0.1
  • aom Ubuntu Pro 22.04 LTS 3.3.0-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2026-56208

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • aom enterprise linux ai 3.5, enterprise linux ai 3.4, enterprise linux ai 3.3 3.14.0-1.el9ai
  • libaom enterprise linux ai 3.5, enterprise linux ai 3.4, enterprise linux ai 3.3 3.14.0-1.el9ai
  • firefox RHEL 9 140.13.0-1.el9_8
  • firefox-x11 RHEL 9 140.13.0-1.el9_8
  • firefox RHEL 8 140.13.0-1.el8_10
  • aom hummingbird 1 3.14.0-0.1.hum1
  • libaom hummingbird 1 3.14.0-0.1.hum1
  • firefox RHEL 8.8 TUS, RHEL 8.8 E4S 140.13.0-1.el8_8

red hat advisories RHSA-2026:54339RHSA-2026:54259RHSA-2026:54249RHSA-2026:54248RHSA-2026:54185RHSA-2026:54182

  • libaom SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 3.7.1-150600.3.9.1
  • libyuv SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 20230517+a377993-150600.3.4.2
  • SVT-AV1 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 1.8.0-150600.3.2.5
  • libaom SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 3.7.1-150400.3.12.1
  • libaom SLES for SAP applications 16.0, SLES 16.0 3.11.0-160000.3.1

suse advisories SUSE-SU-2026:3224-1SUSE-SU-2026:2829-1SUSE-SU-2026:22369-1

  • libaom openSUSE Tumbleweed 3.15.2-1.1
  • libaom openSUSE Leap 16.0 3.11.0-160000.3.1

opensuse advisories openSUSE-SU-2026:12197-1openSUSE-SU-2026:21061-1

  • firefox AlmaLinux 9 140.13.0-1.el9_8.alma.1
  • firefox-x11 AlmaLinux 9 140.13.0-1.el9_8.alma.1
  • firefox AlmaLinux 8 140.13.0-1.el8_10.alma.1

almalinux advisories ALSA-2026:47104ALSA-2026:47105

  • firefox Rocky Linux 9 140.13.0-1.el9_8
  • firefox Rocky Linux 8 140.13.0-1.el8_10

rocky linux advisories RLSA-2026:47104RLSA-2026:47105

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56208 updated cvss 7.6

libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode

  • Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +5 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 10 firefox
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1787860580, rhaiis/vllm-rocm-rhel9 1787884873, rhaiis/model-opt-cuda-rhel9 1787772157
    fixed: vendor fix RHSA-2026:61628
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287
    fixed: vendor fix RHSA-2026:68696
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 more
    fixed: vendor fix RHSA-2026:76041
  • Red Hat Enterprise Linux AI 3.3 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:51100
  • Red Hat Enterprise Linux AI 3.4 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:51146
  • Red Hat Enterprise Linux AI 3.5 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:42875
show 21 more
  • Red Hat Enterprise Linux AppStream (v. 8) firefox 140.13.0-1.el8_10
    fixed: vendor fix RHSA-2026:47105
  • Red Hat Enterprise Linux AppStream (v. 9) firefox 140.13.0-1.el9_8, firefox-x11 140.13.0-1.el9_8
    fixed: vendor fix RHSA-2026:47104
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox 140.13.0-1.el8_4
    fixed: vendor fix RHSA-2026:54180
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) firefox 140.13.0-1.el8_6
    fixed: vendor fix RHSA-2026:54259
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) firefox 140.13.0-1.el8_8
    fixed: vendor fix RHSA-2026:54339
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) firefox 140.13.0-1.el9_2, firefox-x11 140.13.0-1.el9_2
    fixed: vendor fix RHSA-2026:54185
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) firefox 140.13.0-1.el9_4, firefox-x11 140.13.0-1.el9_4
    fixed: vendor fix RHSA-2026:54182
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) firefox 140.13.0-1.el10_0
    fixed: vendor fix RHSA-2026:54181
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) firefox 140.13.0-1.el9_6, firefox-x11 140.13.0-1.el9_6
    fixed: vendor fix RHSA-2026:54249
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) firefox 140.13.0-1.el8_4
    fixed: vendor fix RHSA-2026:54180
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) firefox 140.13.0-1.el8_6
    fixed: vendor fix RHSA-2026:54259
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) firefox 140.13.0-1.el8_8
    fixed: vendor fix RHSA-2026:54339
  • Red Hat Enterprise Linux Server (v. 7 ELS) firefox 140.13.0-1.el7_9
    fixed: vendor fix RHSA-2026:54248
  • Red Hat Hardened Images aom 3.14.0-0.1.hum1, libaom 3.14.0-0.1.hum1
    fixed: vendor fix RHSA-2026:30814
  • Red Hat OpenShift AI 3.3 rhai/base-image-cpu-rhel9 1789137641, rhai/base-image-tpu-rhel9 1789137548, rhai/base-image-spyre-rhel9 1789137607, rhai/base-image-neuron-rhel9 1789137552, rhai/base-image-rocm-6.4-rhel9 1789137548, rhai/base-image-rocm-7.0-rhel9 1789137548, +2 more
    fixed: vendor fix RHSA-2026:68708
  • Red Hat OpenShift AI 3.4 rhoai/odh-mlserver-rhel9 1786611800, rhai/base-image-cpu-rhel9 1788197530, rhai/base-image-tpu-rhel9 1788197680, rhai/base-image-gaudi-rhel9 1788197632, rhai/base-image-spyre-rhel9 1788197747, rhai/base-image-rocm-6.4-rhel9 1788197677, +7 more
    fixed: vendor fix RHSA-2026:69929
  • Red Hat OpenShift AI 3.5 rhai/base-image-cpu-rhel9 1788198407, rhai/base-image-cpu-rhel9 1790703656, rhai/base-image-tpu-rhel9 1788197492, rhai/base-image-tpu-rhel9 1790703554, rhai/base-image-gaudi-rhel9 1788197542, rhai/base-image-gaudi-rhel9 1790703552, +11 more
    fixed: vendor fix RHSA-2026:71393
  • Red Hat Enterprise Linux 8 thunderbird
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 9 thunderbird
    not affected: component not present
  • Red Hat Enterprise Linux 10 thunderbird Red Hat OpenShift AI (RHOAI) rhoai/odh-automl-rhel9, rhoai/odh-autorag-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-kserve-autogluon-server-rhel9, +8 more
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-automl-rhel9 1791535789, +201 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CISA ADP 3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9
  • Red Hat Red Hat Enterprise Linux AI 3.4 for RHEL 9
  • Red Hat Red Hat Enterprise Linux AI 3.5 for RHEL 9
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Enterprise Linux AI 3.3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI 3.5
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-122 Heap-based Buffer Overflow

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.