{"id":"CVE-2026-56210","title":"A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation","summary":"A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the co…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"Red Hat","product":"aom","affected":["aom (all versions)","aom (all versions)","aom (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/vllm-spyre-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","aom-main (all versions)","rhai/base-image-neuron-rhel9 (all versions)","rhai/base-image-rocm-7.0-rhel9 (all versions)","rhai/base-image-cuda-13.0-rhel9 (all versions)","rhai/base-image-tpu-rhel9 (all versions)","rhai/base-image-rocm-6.4-rhel9 (all versions)","rhai/base-image-cpu-rhel9 (all versions)","rhai/base-image-spyre-rhel9 (all versions)","rhai/base-image-cuda-12.9-rhel9 (all versions)","rhoai/odh-mlserver-rhel9 (all versions)","rhoai/odh-th06-cpu-torch210-py312-rhel9 (all versions)","rhoai/odh-th06-cuda130-torch210-py312-rhel9 (all versions)","rhoai/odh-th06-rocm64-torch291-py312-rhel9 (all versions)","rhaiis/vllm-cpu-rhel9 (all versions)","rhaiis/vllm-neuron-rhel9 (all versions)","rhaiis/vllm-tpu-rhel9 (all versions)","rhaii/vllm-cpu-rhel9 (all versions)","rhaii/vllm-gaudi-rhel9 (all versions)","rhaii/vllm-neuron-rhel9 (all versions)","rhaii/vllm-tpu-rhel9 (all versions)","firefox (all versions)","thunderbird (all versions)","firefox (all versions)","thunderbird (all versions)","rhai/base-image-gaudi-rhel9 (all versions)","rhai/base-image-rocm-7.1-rhel9 (all versions)","rhoai/odh-automl-rhel9","rhoai/odh-autorag-rhel9","rhoai/odh-kserve-autogluon-server-rhel9","rhoai/odh-llama-stack-core-rhel9","rhoai/odh-llm-d-kv-cache-rhel9","rhoai/odh-spark-operator-rhel9","rhoai/odh-th06-cpu-torch291-py312-rhel9","rhoai/odh-th06-cuda130-torch291-py312-rhel9","rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 (all versions)","rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9","rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9","rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9","rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9"],"patched":["enterprise_linux_ai_3_3_for_rhel 9","enterprise_linux_ai_3_4_for_rhel 9","enterprise_linux_ai_3_5_for_rhel 9","ai_inference_server 3.2","ai_inference_server 3.3","hardened_images","openshift_ai 3.3","openshift_ai 3.4"],"published":"2026-06-19","updated":"2026-09-22","sourceUpdated":"2026-09-22T13:17:09.023","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56210","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30814","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42875","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:51100","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:51146","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68634","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68637","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68638","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68639","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68640","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68696","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68697","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68698","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68699","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68708","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68709","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68710","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69927","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69929","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69930","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69931","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69932","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69933","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69934","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69935","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56210","label":"secalert@redhat.com"},{"url":"https://aomedia.googlesource.com/aom/+/a93ba0ffaa","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490801","label":"secalert@redhat.com"},{"url":"https://issues.chromium.org/issues/503975732","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30814","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42875","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51100","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56210","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490801","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56210"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56210"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00308,"epssPercentile":0.23855,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-22T18:22:57.799192Z"},"ingestedAt":"2026-06-29T13:42:11.975Z","slug":"CVE-2026-56210","body":"## Overview\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:51100** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51100)\n- **RHSA-2026:51146** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51146)\n- **RHSA-2026:42875** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.5 for RHEL 9 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42875)\n- **RHSA-2026:61628** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61628)\n- **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627)\n- **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629)\n- **RHSA-2026:68696** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68696)\n- **RHSA-2026:68699** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68699)\n- **RHSA-2026:68698** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68698)\n- **RHSA-2026:68697** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68697)\n- **RHSA-2026:30814** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30814)\n- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI) · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}