Skip to content
Fencer Vulns
high 7.1

CVE-2026-56210 json

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

published 2026-06-19 4 mo ago modified 2026-11-04 4 d ago also EUVD-2026-38046

cvss
7.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

Patch / fix

  • Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat Enterprise Linux AI 3.4 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat Enterprise Linux AI 3.5 for RHEL 9 0:3.14.0-1.el9ai
  • Red Hat Red Hat AI Inference Server 3.2 1787772157, 1787860580, 1787884873
  • Red Hat Red Hat AI Inference Server 3.3 1789502493, 1789504371, 1789508287, 1789582776
  • Red Hat Red Hat Enterprise Linux AI 3.3 1790791893, 1790850900, 1790866732, 1790936334, 1790936351, 1790954179
  • Red Hat Red Hat Hardened Images 3.14.0-0.1.hum1
  • Red Hat Red Hat OpenShift AI 3.3 1789137548, 1789137552, 1789137607, 1789137636, 1789137641
  • Red Hat Red Hat OpenShift AI 3.4 1786611800, 1787076481, 1787076778, 1787077779, 1788197530, 1788197549, 1788197632, 1788197677, 1788197680, 1788197744, 1788197747, 1788199622, 1791785804
  • Red Hat Red Hat OpenShift AI 3.5 1788197385, 1788197492, 1788197512, 1788197542, 1788197688, 1788197975, 1788198016, 1788198404, 1788198407, 1790703552, 1790703554, 1790703557, 1790703630, 1790703645, 1790703656, 1790703706
  • aom Debian 12 3.6.0-1+deb12u3
  • aom Debian 13 3.12.1-1+deb13u1
  • aom Debian 14 3.14.1-1

debian advisories DEBIAN-CVE-2026-56210

  • aom Ubuntu 24.04 LTS 3.8.2-2ubuntu0.2
  • aom Ubuntu 26.04 LTS 3.13.1-2ubuntu0.1
  • aom Ubuntu Pro 22.04 LTS 3.3.0-1ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2026-56210

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • aom enterprise linux ai 3.5, enterprise linux ai 3.4, enterprise linux ai 3.3 3.14.0-1.el9ai
  • libaom enterprise linux ai 3.5, enterprise linux ai 3.4, enterprise linux ai 3.3 3.14.0-1.el9ai
  • aom hummingbird 1 3.14.0-0.1.hum1
  • libaom hummingbird 1 3.14.0-0.1.hum1

red hat advisories RHSA-2026:51146RHSA-2026:51100RHSA-2026:42875RHSA-2026:30814

  • libaom SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 3.7.1-150600.3.9.1
  • libyuv SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 20230517+a377993-150600.3.4.2
  • SVT-AV1 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Desktop Applications 15 SP7 +1 more 1.8.0-150600.3.2.5
  • libaom SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 3.7.1-150400.3.12.1
  • libaom SLES for SAP applications 16.0, SLES 16.0 3.11.0-160000.3.1

suse advisories SUSE-SU-2026:3224-1SUSE-SU-2026:2829-1SUSE-SU-2026:22369-1

  • libaom openSUSE Tumbleweed 3.15.2-1.1
  • libaom openSUSE Leap 16.0 3.11.0-160000.3.1

opensuse advisories openSUSE-SU-2026:12197-1openSUSE-SU-2026:21061-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-56210 updated cvss 7.1

libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

  • Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +5 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbird, firefox 140.11.0-1.el10_2, thunderbird 140.11.0-1.el10_2 Red Hat Enterprise Linux 10 firefox 140.11.0-1.el10_2, thunderbird 140.11.0-1.el10_2
    affected: workaround, no fix available
  • Red Hat AI Inference Server 3.2 rhaiis/vllm-cuda-rhel9 1787860580, rhaiis/vllm-rocm-rhel9 1787884873, rhaiis/model-opt-cuda-rhel9 1787772157
    fixed: vendor fix RHSA-2026:61628
  • Red Hat AI Inference Server 3.3 rhaiis/vllm-cuda-rhel9 1789582776, rhaiis/vllm-rocm-rhel9 1789504371, rhaiis/vllm-spyre-rhel9 1789502493, rhaiis/model-opt-cuda-rhel9 1789508287
    fixed: vendor fix RHSA-2026:68696
  • Red Hat Enterprise Linux AI 3.3 rhelai3/bootc-cuda-rhel9 1790866732, rhelai3/bootc-rocm-rhel9 1790791893, rhelai3/bootc-aws-cuda-rhel9 1790936334, rhelai3/bootc-gcp-cuda-rhel9 1790936334, rhelai3/disk-image-cuda-rhel9 1790954179, rhelai3/bootc-azure-cuda-rhel9 1790936351, +1 more
    fixed: vendor fix RHSA-2026:76041
  • Red Hat Enterprise Linux AI 3.3 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:51100
  • Red Hat Enterprise Linux AI 3.4 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:51146
  • Red Hat Enterprise Linux AI 3.5 for RHEL 9 aom 3.14.0-1.el9ai, libaom 3.14.0-1.el9ai
    fixed: vendor fix RHSA-2026:42875
show 6 more
  • Red Hat Hardened Images aom 3.14.0-0.1.hum1, libaom 3.14.0-0.1.hum1
    fixed: vendor fix RHSA-2026:30814
  • Red Hat OpenShift AI 3.3 rhai/base-image-cpu-rhel9 1789137641, rhai/base-image-tpu-rhel9 1789137548, rhai/base-image-spyre-rhel9 1789137607, rhai/base-image-neuron-rhel9 1789137552, rhai/base-image-rocm-6.4-rhel9 1789137548, rhai/base-image-rocm-7.0-rhel9 1789137548, +2 more
    fixed: vendor fix RHSA-2026:68708
  • Red Hat OpenShift AI 3.4 rhoai/odh-mlserver-rhel9 1786611800, rhai/base-image-cpu-rhel9 1788197530, rhai/base-image-tpu-rhel9 1788197680, rhai/base-image-gaudi-rhel9 1788197632, rhai/base-image-spyre-rhel9 1788197747, rhai/base-image-rocm-6.4-rhel9 1788197677, +7 more
    fixed: vendor fix RHSA-2026:69929
  • Red Hat OpenShift AI 3.5 rhai/base-image-cpu-rhel9 1788198407, rhai/base-image-cpu-rhel9 1790703656, rhai/base-image-tpu-rhel9 1788197492, rhai/base-image-tpu-rhel9 1790703554, rhai/base-image-gaudi-rhel9 1788197542, rhai/base-image-gaudi-rhel9 1790703552, +11 more
    fixed: vendor fix RHSA-2026:71393
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-automl-rhel9, rhoai/odh-autorag-rhel9, rhoai/odh-llm-d-kv-cache-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-llama-stack-core-rhel9, rhoai/odh-kserve-autogluon-server-rhel9, +8 more
    not affected: vulnerable code not in execute path
  • Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1787330837, rhoai/odh-cli-rhel9 1791509689, rhoai/rhai-cli-rhel9 1787330837, rhoai/rhai-cli-rhel9 1791509689, rhoai/odh-automl-rhel9 1786612415, rhoai/odh-automl-rhel9 1791535789, +201 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
4 mo ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CISA ADP 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9
  • Red Hat Red Hat Enterprise Linux AI 3.4 for RHEL 9
  • Red Hat Red Hat Enterprise Linux AI 3.5 for RHEL 9
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Enterprise Linux AI 3.3
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift AI 3.4
  • Red Hat Red Hat OpenShift AI 3.5
  • Red Hat Red Hat AI Inference Server
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.