InfoSec Signals™
Sign InStart Free
Back to CVE records
High 7.1Published Jun 19, 2026

CVE-2026-56211Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Updated under an hour ago ()

Does this affect you?

It affects Red Hat Enterprise Linux AI 3.3 for RHEL 9 and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

CVSS
7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
Weakness (CWE)
CWE-787
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
redhat
NVD analysis
Awaiting Analysis
Record last updated
Oct 9, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
from 0:3.14.0-1.el9ai not affected
CNA record
Red Hat Red Hat AI Inference Server 3.2
redhat:ai_inference_server
from 1787860580 not affected
CNA record
from 3.14.0-0.1.hum1 not affected
CNA record
from 1789137552 not affected
CNA record
10
CNA record
from 0:3.14.0-1.el9ai not affected
CISA ADP
from 3.14.0-0.1.hum1 not affected
CISA ADP
from 1786611800 not affected
CISA ADP
Red Hat Red Hat AI Inference Server
redhat:ai_inference_server
3
CISA ADP
10
CISA ADP

References

  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat
  • vendor-advisory, x-refsource-redhat

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.