--- id: CVE-2026-56208 title: >- A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation summary: >- A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when … severity: high cvss: 7.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H' cwe: - CWE-122 vendor: Red Hat product: firefox affected: - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - firefox (all versions) - aom (all versions) - aom (all versions) - aom (all versions) - rhaiis/vllm-cuda-rhel9 (all versions) - rhaiis/model-opt-cuda-rhel9 (all versions) - rhaiis/vllm-rocm-rhel9 (all versions) - rhaiis/model-opt-cuda-rhel9 (all versions) - rhaiis/vllm-spyre-rhel9 (all versions) - rhaiis/vllm-rocm-rhel9 (all versions) - rhaiis/vllm-cuda-rhel9 (all versions) - aom-main (all versions) - rhai/base-image-neuron-rhel9 (all versions) - rhai/base-image-rocm-7.0-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-rocm-6.4-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-spyre-rhel9 (all versions) - rhai/base-image-cuda-12.9-rhel9 (all versions) - rhoai/odh-mlserver-rhel9 (all versions) - rhoai/odh-th06-cpu-torch210-py312-rhel9 (all versions) - rhoai/odh-th06-cuda130-torch210-py312-rhel9 (all versions) - rhoai/odh-th06-rocm64-torch291-py312-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-gaudi-rhel9 (all versions) - rhai/base-image-spyre-rhel9 (all versions) - rhai/base-image-rocm-7.1-rhel9 (all versions) - rhai/base-image-cuda-12.9-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-rocm-6.4-rhel9 (all versions) - rhai/base-image-neuron-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-gaudi-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-rubin-rhel9 (all versions) patched: - enterprise_linux_server_v_7_els - enterprise_linux_ai_3_3_for_rhel 9 - enterprise_linux_ai_3_4_for_rhel 9 - enterprise_linux_ai_3_5_for_rhel 9 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_aus_v_8_4 - enterprise_linux_appstream_eus_extension_v_8_4 - enterprise_linux_appstream_aus_v_8_6 - enterprise_linux_appstream_eus_extension_v_8_6 - enterprise_linux_appstream_e4s_v_8_8 - enterprise_linux_appstream_tus_v_8_8 - enterprise_linux_appstream_e4s_v_9_2 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - ai_inference_server 3.2 - ai_inference_server 3.3 - hardened_images - openshift_ai 3.3 - openshift_ai 3.4 published: '2026-06-19' updated: '2026-09-24' sourceUpdated: '2026-09-24T09:17:05.190' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56208' references: - url: 'https://access.redhat.com/errata/RHSA-2026:30814' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42875' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:47104' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:47105' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:51100' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:51146' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54180' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54181' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54182' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54185' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54248' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54249' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54259' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54339' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61627' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61628' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61629' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68634' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68637' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68638' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68639' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68640' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68696' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68697' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68698' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68699' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68708' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68709' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68710' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69927' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69929' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69930' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69931' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69932' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69933' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69934' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69935' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71392' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71393' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71394' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71395' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71396' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71397' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71398' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71399' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71401' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-56208' label: secalert@redhat.com - url: 'https://aomedia.googlesource.com/aom/+/243f8ae84b' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490799' label: secalert@redhat.com - url: 'https://issues.chromium.org/issues/504317456' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:30814' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42875' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47104' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:47105' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:51100' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:51146' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54180' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54181' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54182' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54185' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54248' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54249' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54259' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:54339' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61627' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61628' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61629' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-56208' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490799' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56208' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56208' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-25T03:55:29.788406Z' epss: 0.00421 epssPercentile: 0.33737 ingestedAt: '2026-06-29T13:42:11.971Z' --- ## Overview A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:54248** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54248) - **RHSA-2026:51100** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51100) - **RHSA-2026:51146** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51146) - **RHSA-2026:42875** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.5 for RHEL 9 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42875) - **RHSA-2026:54181** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54181) - **RHSA-2026:47105** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:47105) - **RHSA-2026:54180** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54180) - **RHSA-2026:54259** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54259) - **RHSA-2026:54339** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54339) - **RHSA-2026:54185** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54185) - **RHSA-2026:54182** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-08-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:54182) - **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json)