Executive brief
A memory corruption vulnerability exists in libaom, a widely used software library for encoding and decoding AV1 video. This library is commonly used in web browsers, video conferencing tools like WebRTC, and cloud video transcoding services. An attacker could exploit this flaw to crash the application or potentially gain unauthorized control over the system by providing specially crafted video encoding settings or processing malicious video streams.
Technical details
A heap buffer overflow exists in libaom's AV1 encoder due to a logic error in the Look-Ahead Processing (LAP) mode. When the 'g_lag_in_frames' parameter is set to 1 or higher, the encoder operates in a single-pass mode that fails to trigger the wrap-around guard for the first-pass stats ring buffer in 'update_firstpass_stats()'. This results in a 232-byte out-of-bounds write of FIRSTPASS_STATS structures for every frame after the second, corrupting adjacent heap memory and metadata. The vulnerability is reachable in environments where an attacker can influence encoder configurations, such as WebRTC sessions or transcoding services. A fix is available in version 3.14.0 via commit 243f8ae84b.
Affected products
- Alliance for Open Media (AOMedia) libaom 2.0.0 to 3.13.3
- Red Hat Red Hat Enterprise Linux 9 affected
- Red Hat Red Hat Enterprise Linux 10 affected
- Mozilla Firefox affected
- Mozilla Thunderbird affected
Timeline
- 2026-04-20: patched: Upstream fix committed to libaom repository
- 2026-06-19: disclosed: Public disclosure of CVE-2026-56208