Executive brief
A security vulnerability exists in libaom, a widely used software library for encoding and decoding AV1 video. This library is integrated into many web browsers, media players, and video streaming services. An attacker could exploit this flaw to crash the application or potentially access sensitive information stored in the system's memory by providing specially crafted video parameters.
Technical details
A heap-buffer-overflow read vulnerability exists in libaom's SVC (Scalable Video Coding) layer ID control function, specifically within `ctrl_set_layer_id()` in `av1/av1_cx_iface.c`. The root cause is a missing bounds check that allows a `spatial_layer_id` to exceed the number of configured layers. When the encoder computes a `layer_context[]` array index during `av1_one_pass_cbr_svc_start_layer()`, it performs an out-of-bounds heap read of approximately 40,728 bytes. An attacker who can influence SVC encoder parameters can trigger this to leak heap memory contents or cause a segmentation fault (DoS). The issue is fixed in libaom version 3.14.0 and commit a93ba0ffaa.
Affected products
- Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3
- Red Hat Enterprise Linux 9 9
- Red Hat Enterprise Linux 10 10
- Red Hat Enterprise Linux AI 3 3
Timeline
- 2026-04-19: patched: Fix committed upstream in a93ba0ffaa
- 2026-06-19: disclosed: Public disclosure and CVE assignment