CVE-2026-56208: AOMedia libaom heap buffer overflow in AV1 encoder LAP mode

CVE-2026-56208 · Severity: high · CVSS 7.6 · Published 2026-06-19

A memory corruption vulnerability exists in libaom, a widely used software library for encoding and decoding AV1 video. This library is commonly used in web browsers, video conferencing tools like WebRTC, and cloud video transcoding services. An attacker could exploit this flaw to crash the application or potentially gain unauthorized control over the system by providing specially crafted video encoding settings or processing malicious video streams.

Technologies: AOMedia Libaom, Mozilla Firefox, Mozilla Thunderbird, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: AOMedia, Mozilla, Red Hat.

Quick answers

Is CVE-2026-56208 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56208 being exploited in the wild.
How severe is CVE-2026-56208?
High severity, with a CVSS score of 7.6, published 19 June 2026.
Which products and versions are affected?
AOMedia Libaom 2.0.0 to 3.13.3; Mozilla Firefox affected; Mozilla Thunderbird affected; Red Hat Enterprise Linux 10 affected; and 1 more.
Is there a fix for CVE-2026-56208?
A patch was published on 2026-04-20: Upstream fix committed to libaom repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56208 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-56208?
Check whether you run AOMedia Libaom, Mozilla Firefox, Mozilla Thunderbird or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap buffer overflow exists in libaom's AV1 encoder due to a logic error in the Look-Ahead Processing (LAP) mode. When the 'g_lag_in_frames' parameter is set to 1 or higher, the encoder operates in a single-pass mode that fails to trigger the wrap-around guard for the first-pass stats ring buffer in 'update_firstpass_stats()'. This results in a 232-byte out-of-bounds write of FIRSTPASS_STATS structures for every frame after the second, corrupting adjacent heap memory and metadata. The vulnerability is reachable in environments where an attacker can influence encoder configurations, such as WebRTC sessions or transcoding services. A fix is available in version 3.14.0 via commit 243f8ae84b.

Affected products

  • Alliance for Open Media (AOMedia) libaom 2.0.0 to 3.13.3
  • Red Hat Red Hat Enterprise Linux 9 affected
  • Red Hat Red Hat Enterprise Linux 10 affected
  • Mozilla Firefox affected
  • Mozilla Thunderbird affected

Timeline

  • 2026-04-20: patched: Upstream fix committed to libaom repository
  • 2026-06-19: disclosed: Public disclosure of CVE-2026-56208

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.