Heap Buffer Overflow Vulnerability in libaom Reference AV1 Codec Implementation
CVE-2026-56208

7.6HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux Ai (rhel Ai) 3
Red Hat Hardened Images
Vendor
CVE Published:
19 June 2026

What is CVE-2026-56208?

A heap buffer overflow vulnerability has been identified in the libaom AV1 codec implementation. This issue arises from a flaw in the Look-Ahead Processing (LAP) mode of the AV1 encoder, where the first-pass statistics ring buffer wrap-around guard is bypassed when g_lag_in_frames is set to 1 or higher. This vulnerability allows for a 232-byte out-of-bounds write for every encoded frame following the second one, which can corrupt adjacent heap objects. Attackers capable of modifying the encoder configuration in a transcoding service or WebRTC session may exploit this flaw, potentially resulting in a process crash or allowing unauthorized code execution.

References

https://access.redhat.com/security/cve/CVE-2026-56208
vdb-entryx_refsource_REDHAT
https://aomedia.googlesource.com/aom/+/243f8ae84b
https://bugzilla.redhat.com/show_bug.cgi?id=2490799
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank The FuzzAnything Team (FuzzAnything) for reporting this issue.
.