CVE-2026-56209
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
An arbitrary address write vulnerability in libaom, the reference AV1 codec implementation, allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via a missing bounds check in the SVC layer ID control function. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.
Risk Assessment
A remote attacker could cause encoder crashes or potentially execute arbitrary code, posing a serious threat to systems using libaom with SVC enabled.
Recommendation
Update the libaom library to the latest version containing a fix for this vulnerability.
Other vulnerabilities in libaom
See all- CVE-2026-56211High
The libaom library (reference AV1 codec implementation) contains a remote code execution vulnerability. Insufficient bounds validation in the AV1 encoder's SVC layer ID control allows an attacker to supply crafted video frames that can overwrite encoder context structures.
- CVE-2026-56210High
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers, causing an out-of-bounds heap read of approximately 40,728 bytes.
- CVE-2026-56208High
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects.
Original NVD description (English source)
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.