Is CVE-2026-56211 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56211 being exploited in the wild.

How severe is CVE-2026-56211?

High severity, with a CVSS score of 7.1, published 19 June 2026.

Which products and versions are affected?

Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 9 affected.

Is there a fix for CVE-2026-56211?

A patch was published on 2026-04-19: Upstream fix committed to aomedia repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56211 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56211?

Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56211: AOMedia libaom remote code execution in AV1 SVC encoder

CVE-2026-56211 · Severity: high · CVSS 7.1 · Published 2026-06-19

A remote code execution vulnerability exists in libaom, a widely used library for encoding and decoding AV1 video. An attacker can exploit this by providing specially crafted video frames to a service that processes video, such as a streaming platform or video conversion tool. If successful, the attacker could take full control of the affected server, potentially leading to data theft, service disruption, or further network intrusion.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Red Hat.

Quick answers

Is CVE-2026-56211 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56211 being exploited in the wild.
How severe is CVE-2026-56211?: High severity, with a CVSS score of 7.1, published 19 June 2026.
Which products and versions are affected?: Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 9 affected.
Is there a fix for CVE-2026-56211?: A patch was published on 2026-04-19: Upstream fix committed to aomedia repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56211 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56211?: Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based out-of-bounds write (CWE-787) exists in libaom's AV1 encoder due to insufficient bounds validation in the Scalable Video Coding (SVC) layer ID control. Specifically, the `ctrl_set_layer_id()` function in `av1/av1_cx_iface.c` fails to validate spatial and temporal layer IDs, allowing an attacker to reference a non-existent `LAYER_CONTEXT` entry. In certain configurations, this "ghost" entry overlaps with attacker-controlled image Y-plane data. An attacker can leverage this to hijack the `cyclic refresh map` pointer. In fork-based environments, this can be used as a crash oracle to bypass ASLR/PIE and eventually redirect control flow (e.g., via GOT.PLT overwrites) to achieve arbitrary command execution. The issue is fixed in upstream commit a93ba0ffaa and released in version 3.14.0.

Affected products

Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3-389-gdc2644ef7e
Red Hat Enterprise Linux 9 affected
Red Hat Enterprise Linux 10 affected

Timeline

2026-04-19: patched: Upstream fix committed to aomedia repository
2026-06-19: disclosed: CVE-2026-56211 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.