Executive brief
A remote code execution vulnerability exists in libaom, a widely used library for encoding and decoding AV1 video. An attacker can exploit this by providing specially crafted video frames to a service that processes video, such as a streaming platform or video conversion tool. If successful, the attacker could take full control of the affected server, potentially leading to data theft, service disruption, or further network intrusion.
Technical details
A heap-based out-of-bounds write (CWE-787) exists in libaom's AV1 encoder due to insufficient bounds validation in the Scalable Video Coding (SVC) layer ID control. Specifically, the `ctrl_set_layer_id()` function in `av1/av1_cx_iface.c` fails to validate spatial and temporal layer IDs, allowing an attacker to reference a non-existent `LAYER_CONTEXT` entry. In certain configurations, this "ghost" entry overlaps with attacker-controlled image Y-plane data. An attacker can leverage this to hijack the `cyclic refresh map` pointer. In fork-based environments, this can be used as a crash oracle to bypass ASLR/PIE and eventually redirect control flow (e.g., via GOT.PLT overwrites) to achieve arbitrary command execution. The issue is fixed in upstream commit a93ba0ffaa and released in version 3.14.0.
Affected products
- Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3-389-gdc2644ef7e
- Red Hat Enterprise Linux 9 affected
- Red Hat Enterprise Linux 10 affected
Timeline
- 2026-04-19: patched: Upstream fix committed to aomedia repository
- 2026-06-19: disclosed: CVE-2026-56211 published