# CVE-2026-56211: AOMedia libaom remote code execution in AV1 SVC encoder

Source: https://junglewise.ai/threats/cve-2026-56211-aomedia-libaom-remote-code-execution-in-av1-svc-encoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-19. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56211 · Severity: high · CVSS 7.1 · Published 2026-06-19

A remote code execution vulnerability exists in libaom, a widely used library for encoding and decoding AV1 video. An attacker can exploit this by providing specially crafted video frames to a service that processes video, such as a streaming platform or video conversion tool. If successful, the attacker could take full control of the affected server, potentially leading to data theft, service disruption, or further network intrusion.

Technologies: [Red Hat Enterprise Linux 10](https://junglewise.ai/threats/technologies/enterprise-linux-10), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-56211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56211 being exploited in the wild.

**How severe is CVE-2026-56211?** High severity, with a CVSS score of 7.1, published 19 June 2026.

**Which products and versions are affected?** Red Hat Enterprise Linux 10 affected; Red Hat Enterprise Linux 9 affected.

**Is there a fix for CVE-2026-56211?** A patch was published on 2026-04-19: Upstream fix committed to aomedia repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56211 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-56211?** Check whether you run Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based out-of-bounds write (CWE-787) exists in libaom's AV1 encoder due to insufficient bounds validation in the Scalable Video Coding (SVC) layer ID control. Specifically, the `ctrl_set_layer_id()` function in `av1/av1_cx_iface.c` fails to validate spatial and temporal layer IDs, allowing an attacker to reference a non-existent `LAYER_CONTEXT` entry. In certain configurations, this "ghost" entry overlaps with attacker-controlled image Y-plane data. An attacker can leverage this to hijack the `cyclic refresh map` pointer. In fork-based environments, this can be used as a crash oracle to bypass ASLR/PIE and eventually redirect control flow (e.g., via GOT.PLT overwrites) to achieve arbitrary command execution. The issue is fixed in upstream commit a93ba0ffaa and released in version 3.14.0.

## Affected products

- Alliance for Open Media (AOMedia) libaom v1.0.0 to v3.13.3-389-gdc2644ef7e
- Red Hat Enterprise Linux 9 affected
- Red Hat Enterprise Linux 10 affected

## Timeline

- 2026-04-19: patched: Upstream fix committed to aomedia repository
- 2026-06-19: disclosed: CVE-2026-56211 published

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-56211](https://access.redhat.com/security/cve/CVE-2026-56211)
- [https://aomedia.googlesource.com/aom/+/a93ba0ffaa](https://aomedia.googlesource.com/aom/+/a93ba0ffaa)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2490802](https://bugzilla.redhat.com/show_bug.cgi?id=2490802)
- [https://issues.chromium.org/issues/503993985](https://issues.chromium.org/issues/503993985)

## Related threats

- [Red Hat yggdrasil-worker-package-manager argument injection in APT backend](https://junglewise.ai/threats/cve-2026-18157-red-hat-yggdrasil-worker-package-manager-argument-injection-in)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)
- [Samba internal DNS server denial of service via TKEY cache exhaustion](https://junglewise.ai/threats/cve-2026-58218-samba-internal-dns-server-denial-of-service-via-tkey-cache)
- [Red Hat PCP auth bypass in pmproxy /store endpoint](https://junglewise.ai/threats/cve-2026-16527-red-hat-pcp-auth-bypass-in-pmproxy-store-endpoint)