← CVE Intelligence

CVE-2026-56211

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames PUBLISHED

Description (CNA)

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Enterprise Linux AI 3.3 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat Enterprise Linux AI 3.4 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat Enterprise Linux AI 3.5 for RHEL 9unaffected 0:3.14.0-1.el9ai before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787860580 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787772157 before *
Red Hat / Red Hat AI Inference Server 3.2unaffected 1787884873 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789508287 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789502493 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789504371 before *
Red Hat / Red Hat AI Inference Server 3.3unaffected 1789582776 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936334 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936351 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790850900 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790866732 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790936334 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790791893 before *
Red Hat / Red Hat Enterprise Linux AI 3.3unaffected 1790954179 before *
Red Hat / Red Hat Hardened Imagesunaffected 3.14.0-0.1.hum1 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137552 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137636 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137548 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137641 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137607 before *
Red Hat / Red Hat OpenShift AI 3.3unaffected 1789137636 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1786611800 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787076778 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787077779 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1787076481 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197680 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197530 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197632 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197747 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197549 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788199622 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197744 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1788197677 before *
Red Hat / Red Hat OpenShift AI 3.4unaffected 1791785804 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198404 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198407 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197492 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197542 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197975 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197512 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197688 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788197385 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1788198016 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703552 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703656 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703557 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703645 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703554 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703554 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703630 before *
Red Hat / Red Hat OpenShift AI 3.5unaffected 1790703706 before *
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat AI Inference Serveraffected
Red Hat / Red Hat Enterprise Linux 10affected
Red Hat / Red Hat Enterprise Linux 10affected
Red Hat / Red Hat Enterprise Linux 9affected
Red Hat / Red Hat Enterprise Linux 9affected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected
Red Hat / Red Hat OpenShift AI (RHOAI)unaffected

CWE

CWE-787

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.