CVE-2026-56210Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
Updated under an hour ago ()
Does this affect you?
It affects Red Hat Enterprise Linux AI 3.3 for RHEL 9 and 4 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
- Weakness (CWE)
- CWE-125
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- redhat
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 9, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 redhat:enterprise_linux_ai | from 0:3.14.0-1.el9ai not affected | CNA record |
Red Hat Red Hat AI Inference Server 3.2 redhat:ai_inference_server | from 1787860580 not affected | CNA record |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 3.14.0-0.1.hum1 not affected | CNA record |
Red Hat Red Hat OpenShift AI 3.3 redhat:openshift_ai | from 1789137552 not affected | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | 10 | CNA record |
Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9 redhat:enterprise_linux_ai | from 0:3.14.0-1.el9ai not affected | CISA ADP |
Red Hat Red Hat Hardened Images redhat:hummingbird | from 3.14.0-0.1.hum1 not affected | CISA ADP |
Red Hat Red Hat OpenShift AI 3.4 redhat:openshift_ai | from 1786611800 not affected | CISA ADP |
Red Hat Red Hat AI Inference Server redhat:ai_inference_server | 3 | CISA ADP |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | 10 | CISA ADP |
References
- https://access.redhat.com/errata/RHSA-2026:30814vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:42875vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:51100vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:51146vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:60520vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61627vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61628vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:61629vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68634vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68637vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68638vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68639vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68640vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68696vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68697vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68698vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68699vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68708vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68709vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:68710vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69927vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69929vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69930vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69931vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2026:69932vendor-advisory, x-refsource-redhat
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.