Executive brief
A vulnerability was found in libaom, a widely used software library for encoding AV1 video. By providing specially crafted video frames to an application using this library, an attacker can cause the software to crash or potentially execute unauthorized code. This affects services that process user-uploaded video or real-time video conferencing tools, potentially leading to service outages or data security risks.
Technical details
An arbitrary address write vulnerability exists in libaom due to a missing bounds check in the `ctrl_set_layer_id()` function within `av1/av1_cx_iface.c`. An attacker can exploit this by providing crafted image pixel values that cause an out-of-bounds read in the SVC layer context, which is then used to inject an arbitrary pointer into the `cyclic refresh map` field. The encoder subsequently writes approximately 1,200 bytes of data (values 0x00 or 0x01) to the attacker-controlled memory address. This vulnerability is deterministic and can be triggered by any network-facing application that uses libaom with SVC enabled, such as video conferencing or transcoding services. The issue was fixed in upstream commit a93ba0ffaa and released in version 3.14.0.
Affected products
- Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- Mozilla Firefox
- Mozilla Thunderbird
Timeline
- 2026-04-19: patched: Upstream fix committed to libaom repository
- 2026-06-19: disclosed: Public advisory and CVE assignment