# CVE-2026-56210: AOMedia libaom heap buffer overflow in SVC layer ID control

Source: https://junglewise.ai/threats/cve-2026-56210-aomedia-libaom-heap-buffer-overflow-in-svc-layer-id-control  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56210 · Severity: high · CVSS 7.1 · Published 2026-06-19

A security vulnerability exists in libaom, a widely used software library for encoding and decoding AV1 video. This library is integrated into many web browsers, media players, and video streaming services. An attacker could exploit this flaw to crash the application or potentially access sensitive information stored in the system's memory by providing specially crafted video parameters.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9), [Red Hat Enterprise Linux AI 3](https://junglewise.ai/threats/technologies/enterprise-linux-ai-3). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-56210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56210 being exploited in the wild.

**How severe is CVE-2026-56210?** High severity, with a CVSS score of 7.1, published 19 June 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux 10 10; Red Hat Enterprise Linux 9 9; Red Hat Enterprise Linux AI 3 3.

**Is there a fix for CVE-2026-56210?** A patch was published on 2026-04-19: Fix committed upstream in a93ba0ffaa Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56210 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56210?** Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 or Red Hat Enterprise Linux AI 3 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-buffer-overflow read vulnerability exists in libaom's SVC (Scalable Video Coding) layer ID control function, specifically within `ctrl_set_layer_id()` in `av1/av1_cx_iface.c`. The root cause is a missing bounds check that allows a `spatial_layer_id` to exceed the number of configured layers. When the encoder computes a `layer_context[]` array index during `av1_one_pass_cbr_svc_start_layer()`, it performs an out-of-bounds heap read of approximately 40,728 bytes. An attacker who can influence SVC encoder parameters can trigger this to leak heap memory contents or cause a segmentation fault (DoS). The issue is fixed in libaom version 3.14.0 and commit a93ba0ffaa.

## Affected products

- Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3
- Red Hat Enterprise Linux 9 9
- Red Hat Enterprise Linux 10 10
- Red Hat Enterprise Linux AI 3 3

## Timeline

- 2026-04-19: patched: Fix committed upstream in a93ba0ffaa
- 2026-06-19: disclosed: Public disclosure and CVE assignment

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-56210](https://access.redhat.com/security/cve/CVE-2026-56210)
- [https://aomedia.googlesource.com/aom/+/a93ba0ffaa](https://aomedia.googlesource.com/aom/+/a93ba0ffaa)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2490801](https://bugzilla.redhat.com/show_bug.cgi?id=2490801)
- [https://issues.chromium.org/issues/503975732](https://issues.chromium.org/issues/503975732)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)