Vigie VulnDBEuropean-hosted Vulnerability DB
FR
Menu

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack (Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9)

CVE-2026-56209
HIGH 7.1

At a glance

Source
NVD
EPSS
EPSS 0.64 % · percentile 51 ()
State
PUBLISHED
Published
Updated
Assigner
redhat
NVD status
Awaiting Analysis

Search on…

Description

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Hredhat
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Hredhat-SADP
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:HNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:HNVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary)

European references

Affected products

ProductVersions
Red Hat · Red Hat Enterprise Linux AI 3.3 for RHEL 9unaffected 0:3.14.0-1.el9ai < *
Red Hat · Red Hat Enterprise Linux AI 3.4 for RHEL 9unaffected 0:3.14.0-1.el9ai < *
Red Hat · Red Hat Enterprise Linux AI 3.5 for RHEL 9unaffected 0:3.14.0-1.el9ai < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 1787860580 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 1787772157 < *
Red Hat · Red Hat AI Inference Server 3.2unaffected 1787884873 < *
Red Hat · Red Hat AI Inference Server 3.3unaffected 1789508287 < *
Red Hat · Red Hat AI Inference Server 3.3unaffected 1789502493 < *
Red Hat · Red Hat AI Inference Server 3.3unaffected 1789504371 < *
Red Hat · Red Hat AI Inference Server 3.3unaffected 1789582776 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790936334 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790936351 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790850900 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790866732 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790936334 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790791893 < *
Red Hat · Red Hat Enterprise Linux AI 3.3unaffected 1790954179 < *
Red Hat · Red Hat Hardened Imagesunaffected 3.14.0-0.1.hum1 < *
Red Hat · Red Hat OpenShift AI 3.3unaffected 1789137552 < *
Red Hat · Red Hat OpenShift AI 3.3unaffected 1789137548 < *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD