Back to CVE records
High 7.6Published Jun 19, 2026
CVE-2026-56208Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux 10.0 Extended Update Support and 11 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
- CVSS
- 7.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
- Weakness (CWE)
- CWE-122
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:140.13.0-1.el10_0 not affected | CNA record |
from 0:140.13.0-1.el7_9 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 0:140.13.0-1.el8_10 not affected | CNA record |
from 0:140.13.0-1.el8_4 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support redhat:rhel_eus_long_life | from 0:140.13.0-1.el8_4 not affected | CNA record |
from 0:140.13.0-1.el8_8 not affected | CNA record | |
from 0:140.13.0-1.el8_8 not affected | CNA record | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:140.13.0-1.el9_6 not affected | CNA record |
Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 redhat:enterprise_linux_ai | from 0:3.14.0-1.el9ai not affected | CNA record |
Red Hat Red Hat AI Inference Server 3.2 redhat:ai_inference_server | from 1787860580 not affected | CNA record |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 3.14.0-0.1.hum1 not affected | CNA record |
Red Hat Red Hat OpenShift AI 3.3 redhat:openshift_ai | from 1789137552 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support redhat:enterprise_linux_eus | from 0:140.13.0-1.el10_0 not affected | CISA ADP |
from 0:140.13.0-1.el7_9 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 8 redhat:enterprise_linux | from 0:140.13.0-1.el8_10 not affected | CISA ADP |
from 0:140.13.0-1.el8_4 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On redhat:rhel_eus_long_life | from 0:140.13.0-1.el8_4 not affected | CISA ADP |
from 0:140.13.0-1.el8_8 not affected | CISA ADP | |
from 0:140.13.0-1.el8_8 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:140.13.0-1.el9_6 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 redhat:enterprise_linux_ai | from 0:3.14.0-1.el9ai not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 3.14.0-0.1.hum1 not affected | CISA ADP |
Red Hat Red Hat OpenShift AI 3.4 redhat:openshift_ai | from 1786611800 not affected | CISA ADP |
Red Hat Red Hat AI Inference Server redhat:ai_inference_server | 3 | CISA ADP |
References
- https://access.redhat.com/errata/RHSA-2026:30814vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:42875vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47104vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:47105vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:51100vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:51146vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54180vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54181vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54182vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54185vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54248vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54249vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54259vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:54339vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:60520vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61627vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61628vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61629vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68634vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68637vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68638vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68639vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68640vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68696vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68697vendor-advisory, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.