--- id: CVE-2026-56210 title: >- A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation summary: >- A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the co… severity: high cvss: 7.1 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H' cwe: - CWE-125 vendor: Red Hat product: aom affected: - aom (all versions) - aom (all versions) - aom (all versions) - rhaiis/vllm-cuda-rhel9 (all versions) - rhaiis/model-opt-cuda-rhel9 (all versions) - rhaiis/vllm-rocm-rhel9 (all versions) - rhaiis/model-opt-cuda-rhel9 (all versions) - rhaiis/vllm-spyre-rhel9 (all versions) - rhaiis/vllm-rocm-rhel9 (all versions) - rhaiis/vllm-cuda-rhel9 (all versions) - aom-main (all versions) - rhai/base-image-neuron-rhel9 (all versions) - rhai/base-image-rocm-7.0-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-rocm-6.4-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-spyre-rhel9 (all versions) - rhai/base-image-cuda-12.9-rhel9 (all versions) - rhoai/odh-mlserver-rhel9 (all versions) - rhoai/odh-th06-cpu-torch210-py312-rhel9 (all versions) - rhoai/odh-th06-cuda130-torch210-py312-rhel9 (all versions) - rhoai/odh-th06-rocm64-torch291-py312-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-gaudi-rhel9 (all versions) - rhai/base-image-spyre-rhel9 (all versions) - rhai/base-image-rocm-7.1-rhel9 (all versions) - rhai/base-image-cuda-12.9-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-rocm-6.4-rhel9 (all versions) - rhai/base-image-neuron-rhel9 (all versions) - rhai/base-image-cpu-rhel9 (all versions) - rhai/base-image-tpu-rhel9 (all versions) - rhai/base-image-gaudi-rhel9 (all versions) - rhai/base-image-cuda-13.0-rhel9 (all versions) - rhai/base-image-rubin-rhel9 (all versions) - rhai/base-image-spyre-rhel9 (all versions) - rhai/base-image-cuda-12.9-rhel9 (all versions) - rhai/base-image-rocm-7.14-rhel9 (all versions) - rhaiis/vllm-cpu-rhel9 (all versions) - rhaiis/vllm-neuron-rhel9 (all versions) - rhaiis/vllm-tpu-rhel9 (all versions) - rhaii/vllm-cpu-rhel9 (all versions) - rhaii/vllm-gaudi-rhel9 (all versions) - rhaii/vllm-neuron-rhel9 (all versions) - rhaii/vllm-tpu-rhel9 (all versions) - firefox (all versions) - thunderbird (all versions) - firefox (all versions) patched: - enterprise_linux_ai_3_3_for_rhel 9 - enterprise_linux_ai_3_4_for_rhel 9 - enterprise_linux_ai_3_5_for_rhel 9 - ai_inference_server 3.2 - ai_inference_server 3.3 - hardened_images - openshift_ai 3.3 - openshift_ai 3.4 published: '2026-06-19' updated: '2026-09-24' sourceUpdated: '2026-09-24T09:17:06.640' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56210' references: - url: 'https://access.redhat.com/errata/RHSA-2026:30814' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42875' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:51100' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:51146' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61627' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61628' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:61629' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68634' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68637' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68638' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68639' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68640' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68696' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68697' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68698' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68699' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68708' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68709' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:68710' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69927' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69929' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69930' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69931' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69932' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69933' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69934' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:69935' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71392' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71393' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71394' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71395' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71396' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71397' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71398' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71399' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:71401' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-56210' label: secalert@redhat.com - url: 'https://aomedia.googlesource.com/aom/+/a93ba0ffaa' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490801' label: secalert@redhat.com - url: 'https://issues.chromium.org/issues/503975732' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:30814' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42875' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:51100' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:51146' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:60520' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61627' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61628' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:61629' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-56210' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2490801' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-56210' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56210' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-06-22T18:22:57.799192Z' epss: 0.00308 epssPercentile: 0.23854 ingestedAt: '2026-06-29T13:42:11.975Z' --- ## Overview A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory). ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:51100** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51100) - **RHSA-2026:51146** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51146) - **RHSA-2026:42875** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.5 for RHEL 9 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42875) - **RHSA-2026:61628** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61628) - **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627) - **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629) - **RHSA-2026:68696** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68696) - **RHSA-2026:68699** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68699) - **RHSA-2026:68698** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68698) - **RHSA-2026:68697** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68697) - **RHSA-2026:30814** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30814) - **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI) · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json)