← CVE Intelligence

CVE-2026-56209

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack PUBLISHED

Description (CNA)

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux AI 3.3 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat Enterprise Linux AI 3.4 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat Enterprise Linux AI 3.5 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787860580 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787772157 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787884873 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789508287 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789502493 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789504371 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789582776 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936334 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936351 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790850900 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790866732 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936334 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790791893 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790954179 before *
Red Hat / Red Hat Hardened Imagesunaffected 3.14.0-0.1.hum1 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137552 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137636 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137641 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137607 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137636 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1786611800 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787076778 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787077779 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787076481 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197680 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197530 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197632 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197747 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197549 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788199622 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197744 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197677 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1791785804 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198404 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198407 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197492 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197542 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197975 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197512 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197688 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197385 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198016 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703552 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703656 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703557 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703645 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703554 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703554 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703630 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703706 before *
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat Enterprise Linux 10affected
Red Hat / Red Hat Enterprise Linux 10affected
Red Hat / Red Hat Enterprise Linux 9affected
Red Hat / Red Hat Enterprise Linux 9affected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected

CWE

CWE-787

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.