CVE-2026-56209

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.
References
Link Resource
https://access.redhat.com/errata/RHSA-2026:30814
https://access.redhat.com/errata/RHSA-2026:42875
https://access.redhat.com/errata/RHSA-2026:51100
https://access.redhat.com/errata/RHSA-2026:51146
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/errata/RHSA-2026:61627
https://access.redhat.com/errata/RHSA-2026:61628
https://access.redhat.com/errata/RHSA-2026:61629
https://access.redhat.com/errata/RHSA-2026:68634
https://access.redhat.com/errata/RHSA-2026:68637
https://access.redhat.com/errata/RHSA-2026:68638
https://access.redhat.com/errata/RHSA-2026:68639
https://access.redhat.com/errata/RHSA-2026:68640
https://access.redhat.com/errata/RHSA-2026:68696
https://access.redhat.com/errata/RHSA-2026:68697
https://access.redhat.com/errata/RHSA-2026:68698
https://access.redhat.com/errata/RHSA-2026:68699
https://access.redhat.com/errata/RHSA-2026:68708
https://access.redhat.com/errata/RHSA-2026:68709
https://access.redhat.com/errata/RHSA-2026:68710
https://access.redhat.com/errata/RHSA-2026:69927
https://access.redhat.com/errata/RHSA-2026:69929
https://access.redhat.com/errata/RHSA-2026:69930
https://access.redhat.com/errata/RHSA-2026:69931
https://access.redhat.com/errata/RHSA-2026:69932
https://access.redhat.com/errata/RHSA-2026:69933
https://access.redhat.com/errata/RHSA-2026:69934
https://access.redhat.com/errata/RHSA-2026:69935
https://access.redhat.com/errata/RHSA-2026:71392
https://access.redhat.com/errata/RHSA-2026:71393
https://access.redhat.com/errata/RHSA-2026:71394
https://access.redhat.com/errata/RHSA-2026:71395
https://access.redhat.com/errata/RHSA-2026:71396
https://access.redhat.com/errata/RHSA-2026:71397
https://access.redhat.com/errata/RHSA-2026:71398
https://access.redhat.com/errata/RHSA-2026:71399
https://access.redhat.com/errata/RHSA-2026:71401
https://access.redhat.com/errata/RHSA-2026:74771
https://access.redhat.com/errata/RHSA-2026:75652
https://access.redhat.com/errata/RHSA-2026:75654
https://access.redhat.com/errata/RHSA-2026:75657
https://access.redhat.com/errata/RHSA-2026:75658
https://access.redhat.com/errata/RHSA-2026:75659
https://access.redhat.com/errata/RHSA-2026:75660
https://access.redhat.com/errata/RHSA-2026:76041
https://access.redhat.com/errata/RHSA-2026:76042
https://access.redhat.com/errata/RHSA-2026:76043
https://access.redhat.com/errata/RHSA-2026:84734
https://access.redhat.com/security/cve/CVE-2026-56209
https://aomedia.googlesource.com/aom/+/a93ba0ffaa
https://bugzilla.redhat.com/show_bug.cgi?id=2490800
https://issues.chromium.org/issues/503993984
https://access.redhat.com/errata/RHSA-2026:30814
https://access.redhat.com/errata/RHSA-2026:42875
https://access.redhat.com/errata/RHSA-2026:51100
https://access.redhat.com/errata/RHSA-2026:51146
https://access.redhat.com/errata/RHSA-2026:60520
https://access.redhat.com/errata/RHSA-2026:61627
https://access.redhat.com/errata/RHSA-2026:61628
https://access.redhat.com/errata/RHSA-2026:61629
https://access.redhat.com/security/cve/CVE-2026-56209
https://bugzilla.redhat.com/show_bug.cgi?id=2490800
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56209.json
Configurations

No configuration.

History

19 Oct 2026, 12:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:84734 -

06 Oct 2026, 03:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:76041 -
  • () https://access.redhat.com/errata/RHSA-2026:76042 -
  • () https://access.redhat.com/errata/RHSA-2026:76043 -

05 Oct 2026, 11:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:75652 -
  • () https://access.redhat.com/errata/RHSA-2026:75654 -
  • () https://access.redhat.com/errata/RHSA-2026:75657 -
  • () https://access.redhat.com/errata/RHSA-2026:75658 -
  • () https://access.redhat.com/errata/RHSA-2026:75659 -
  • () https://access.redhat.com/errata/RHSA-2026:75660 -

02 Oct 2026, 02:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:74771 -

24 Sep 2026, 09:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:71392 -
  • () https://access.redhat.com/errata/RHSA-2026:71393 -
  • () https://access.redhat.com/errata/RHSA-2026:71394 -
  • () https://access.redhat.com/errata/RHSA-2026:71395 -
  • () https://access.redhat.com/errata/RHSA-2026:71396 -
  • () https://access.redhat.com/errata/RHSA-2026:71397 -
  • () https://access.redhat.com/errata/RHSA-2026:71398 -
  • () https://access.redhat.com/errata/RHSA-2026:71399 -
  • () https://access.redhat.com/errata/RHSA-2026:71401 -

22 Sep 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:69927 -
  • () https://access.redhat.com/errata/RHSA-2026:69929 -
  • () https://access.redhat.com/errata/RHSA-2026:69930 -
  • () https://access.redhat.com/errata/RHSA-2026:69931 -
  • () https://access.redhat.com/errata/RHSA-2026:69932 -
  • () https://access.redhat.com/errata/RHSA-2026:69933 -
  • () https://access.redhat.com/errata/RHSA-2026:69934 -
  • () https://access.redhat.com/errata/RHSA-2026:69935 -

21 Sep 2026, 11:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:68634 -
  • () https://access.redhat.com/errata/RHSA-2026:68637 -
  • () https://access.redhat.com/errata/RHSA-2026:68638 -
  • () https://access.redhat.com/errata/RHSA-2026:68639 -
  • () https://access.redhat.com/errata/RHSA-2026:68640 -
  • () https://access.redhat.com/errata/RHSA-2026:68696 -
  • () https://access.redhat.com/errata/RHSA-2026:68697 -
  • () https://access.redhat.com/errata/RHSA-2026:68698 -
  • () https://access.redhat.com/errata/RHSA-2026:68699 -
  • () https://access.redhat.com/errata/RHSA-2026:68708 -
  • () https://access.redhat.com/errata/RHSA-2026:68709 -
  • () https://access.redhat.com/errata/RHSA-2026:68710 -

Information

Published : 2026-06-19 17:16

Updated : 2026-10-19 12:17


NVD link : CVE-2026-56209

Mitre link : CVE-2026-56209

CVE.ORG link : CVE-2026-56209


JSON object : View

Products Affected

No product.

CWE
CWE-787

Out-of-bounds Write