Is CVE-2026-56209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56209 being exploited in the wild.

How severe is CVE-2026-56209?

High severity, with a CVSS score of 7.1, published 19 June 2026.

Which products and versions are affected?

Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Mozilla Firefox; and 1 more.

Is there a fix for CVE-2026-56209?

A patch was published on 2026-04-19: Upstream fix committed to libaom repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56209 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56209?

Check whether you run Mozilla Firefox, Mozilla Thunderbird, Red Hat Enterprise Linux 10 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56209: AOMedia libaom arbitrary address write in SVC layer ID control

CVE-2026-56209 · Severity: high · CVSS 7.1 · Published 2026-06-19

A vulnerability was found in libaom, a widely used software library for encoding AV1 video. By providing specially crafted video frames to an application using this library, an attacker can cause the software to crash or potentially execute unauthorized code. This affects services that process user-uploaded video or real-time video conferencing tools, potentially leading to service outages or data security risks.

Technologies: Mozilla Firefox, Mozilla Thunderbird, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Mozilla, Red Hat.

Quick answers

Is CVE-2026-56209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56209 being exploited in the wild.
How severe is CVE-2026-56209?: High severity, with a CVSS score of 7.1, published 19 June 2026.
Which products and versions are affected?: Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Mozilla Firefox; and 1 more.
Is there a fix for CVE-2026-56209?: A patch was published on 2026-04-19: Upstream fix committed to libaom repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56209 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56209?: Check whether you run Mozilla Firefox, Mozilla Thunderbird, Red Hat Enterprise Linux 10 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An arbitrary address write vulnerability exists in libaom due to a missing bounds check in the `ctrl_set_layer_id()` function within `av1/av1_cx_iface.c`. An attacker can exploit this by providing crafted image pixel values that cause an out-of-bounds read in the SVC layer context, which is then used to inject an arbitrary pointer into the `cyclic refresh map` field. The encoder subsequently writes approximately 1,200 bytes of data (values 0x00 or 0x01) to the attacker-controlled memory address. This vulnerability is deterministic and can be triggered by any network-facing application that uses libaom with SVC enabled, such as video conferencing or transcoding services. The issue was fixed in upstream commit a93ba0ffaa and released in version 3.14.0.

Affected products

Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3
Red Hat Enterprise Linux 9
Red Hat Enterprise Linux 10
Mozilla Firefox
Mozilla Thunderbird

Timeline

2026-04-19: patched: Upstream fix committed to libaom repository
2026-06-19: disclosed: Public advisory and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.