Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-56209— Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AOMedia libaom是AOMedia组织开源的一个视频编码库。 AOMedia libaom存在安全漏洞，该漏洞源于SVC层ID控制函数缺少边界检查，允许攻击者通过精心设计的图像像素值将任意指针注入循环刷新映射字段，可能导致拒绝服务或潜在代码执行。

CVSS 7.1 · High EPSS 0.64% · P49 Updated Oct 02, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 67

Vendor	Product	Version Range	Status
Red Hat	Red Hat AI Inference Server	`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
Red Hat	Red Hat AI Inference Server 3.2	`1787860580< *`	unaffected
		`1787772157< *`	unaffected
		`1787884873< *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1789508287< *`	unaffected
		`1789502493< *`	unaffected
		`1789504371< *`	unaffected
		`1789582776< *`	unaffected
Red Hat	Red Hat Enterprise Linux 10	`any`	affected
		`any`	affected
Red Hat	Red Hat Enterprise Linux 9	`any`	affected
		`any`	affected
Red Hat	Red Hat Enterprise Linux AI 3.3 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Enterprise Linux AI 3.4 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Enterprise Linux AI 3.5 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Hardened Images	`3.14.0-0.1.hum1< *`	unaffected
Red Hat	Red Hat OpenShift AI (RHOAI)	`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
… +7 more rows
Red Hat	Red Hat OpenShift AI 3.3	`1789137552< *`	unaffected
		`1789137548< *`	unaffected
		`1789137636< *`	unaffected
		`1789137548< *`	unaffected
		`1789137548< *`	unaffected
		`1789137641< *`	unaffected
		`1789137607< *`	unaffected
		`1789137636< *`	unaffected
Red Hat	Red Hat OpenShift AI 3.4	`1786611800< *`	unaffected
		`1787076778< *`	unaffected
		`1787077779< *`	unaffected
		`1787076481< *`	unaffected
		`1788197680< *`	unaffected
		`1788197530< *`	unaffected
		`1788197632< *`	unaffected
		`1788197747< *`	unaffected
… +4 more rows
Red Hat	Red Hat OpenShift AI 3.5	`1788198404< *`	unaffected
		`1788198407< *`	unaffected
		`1788197492< *`	unaffected
		`1788197542< *`	unaffected
		`1788197975< *`	unaffected
		`1788197512< *`	unaffected
		`1788197688< *`	unaffected
		`1788197385< *`	unaffected
… +2 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-56209

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Source: CVE Program / CVE List V5

Vulnerability Description

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存写

Source: CVE Program / CVE List V5

Vulnerability Title

AOMedia libaom 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Enterprise Linux AI 3.3 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.3::el9`
Red Hat	Red Hat Enterprise Linux AI 3.4 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.4::el9`
Red Hat	Red Hat Enterprise Linux AI 3.5 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.5::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787860580 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787772157 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787884873 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789508287 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789502493 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789504371 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789582776 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat Hardened Images	3.14.0-0.1.hum1 ~ *	`cpe:/a:redhat:hummingbird:1`
Red Hat	Red Hat OpenShift AI 3.3	1789137552 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137636 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137641 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137607 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137636 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.4	1786611800 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787076778 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787077779 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787076481 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197680 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197530 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197632 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197747 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197549 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788199622 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197744 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`

II. Public POCs for CVE-2026-56209

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-56209

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-56209 (2)

Vendor Advisories for CVE-2026-56209 (39)

🔗 2490800 – (CVE-2026-56209) CVE-2026-56209 libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack Read full article issue-tracking x_refsource_REDHAT
🔗 RHSA-2026:68640 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:60520 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:30814 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71394 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69934 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61628 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68708 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69932 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68637 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:51146 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69931 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:42875 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71397 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71395 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71401 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68699 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69933 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71392 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68634 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68696 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61629 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71398 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71396 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68639 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68698 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71399 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69930 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71393 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69927 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68638 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69935 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69929 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:74771 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61627 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:51100 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68709 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68710 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68697 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT

Other References for CVE-2026-56209 (1)

https://access.redhat.com/security/cve/CVE-2026-56209 vdb-entry x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-56209

Same Patch Batch · Red Hat · 2026-06-19 · 6 CVEs total

CVE-2026-56208	7.6 HIGH	Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
CVE-2026-56210	7.1 HIGH	Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id
CVE-2026-56211	7.1 HIGH	Libaom: libaom: remote code execution via svc layer context handling with attacker-control
CVE-2026-12706	6.5 MEDIUM	Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
CVE-2026-12726	6.3 MEDIUM	Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux AI 3.3 for RHEL 9

Same vendor: Red Hat

Same weakness: CWE-787

V. Comments for CVE-2026-56209

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-56209— Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Quick assessment

Possible ATT&CK Techniques 1 AI

Affected Version Matrix 67

I. Basic Information for CVE-2026-56209

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-56209

III. Intelligence Information for CVE-2026-56209

Patches & Fixes for CVE-2026-56209 (2)

Vendor Advisories for CVE-2026-56209 (39)

Other References for CVE-2026-56209 (1)

Same Patch Batch · Red Hat · 2026-06-19 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-56209

Leave a comment