Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-56210— Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux AI 3.3 for RHEL 9

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AOMedia libaom是AOMedia组织开源的一个视频编码库。 AOMedia libaom存在缓冲区错误漏洞，该漏洞源于SVC（可伸缩视频编码）层ID控制函数中缺少边界检查，允许设置超出配置层数的spatial_layer_id，导致在计算层上下文数组索引时发生越界堆读取约40,728字节，攻击者可通过影响网络服务中的SVC编码器参数利用此漏洞进行信息泄露或拒绝服务攻击。

CVSS 7.1 · High EPSS 0.58% · P46 Updated Sep 28, 2026

Possible ATT&CK Techniques 2 AI

T1005 · Data from Local System T1499 · Endpoint Denial of Service

Affected Version Matrix 66

Vendor	Product	Version Range	Status
Red Hat	Red Hat AI Inference Server	`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
		`any`	affected
Red Hat	Red Hat AI Inference Server 3.2	`1787860580< *`	unaffected
		`1787772157< *`	unaffected
		`1787884873< *`	unaffected
Red Hat	Red Hat AI Inference Server 3.3	`1789508287< *`	unaffected
		`1789502493< *`	unaffected
		`1789504371< *`	unaffected
		`1789582776< *`	unaffected
Red Hat	Red Hat Enterprise Linux 10	`any`	affected
		`any`	affected
Red Hat	Red Hat Enterprise Linux 9	`any`	affected
		`any`	affected
Red Hat	Red Hat Enterprise Linux AI 3.3 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Enterprise Linux AI 3.4 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Enterprise Linux AI 3.5 for RHEL 9	`0:3.14.0-1.el9ai< *`	unaffected
Red Hat	Red Hat Hardened Images	`3.14.0-0.1.hum1< *`	unaffected
Red Hat	Red Hat OpenShift AI (RHOAI)	`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
		`any`	unaffected
… +7 more rows
Red Hat	Red Hat OpenShift AI 3.3	`1789137552< *`	unaffected
		`1789137548< *`	unaffected
		`1789137636< *`	unaffected
		`1789137548< *`	unaffected
		`1789137548< *`	unaffected
		`1789137641< *`	unaffected
		`1789137607< *`	unaffected
		`1789137636< *`	unaffected
Red Hat	Red Hat OpenShift AI 3.4	`1786611800< *`	unaffected
		`1787076778< *`	unaffected
		`1787077779< *`	unaffected
		`1787076481< *`	unaffected
		`1788197680< *`	unaffected
		`1788197530< *`	unaffected
		`1788197632< *`	unaffected
		`1788197747< *`	unaffected
… +4 more rows
Red Hat	Red Hat OpenShift AI 3.5	`1788198404< *`	unaffected
		`1788198407< *`	unaffected
		`1788197492< *`	unaffected
		`1788197542< *`	unaffected
		`1788197975< *`	unaffected
		`1788197512< *`	unaffected
		`1788197688< *`	unaffected
		`1788197385< *`	unaffected
… +1 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-56210

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Source: CVE Program / CVE List V5

Vulnerability Description

A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Vulnerability Title

AOMedia libaom 缓冲区错误漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE
Red Hat	Red Hat Enterprise Linux AI 3.3 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.3::el9`
Red Hat	Red Hat Enterprise Linux AI 3.4 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.4::el9`
Red Hat	Red Hat Enterprise Linux AI 3.5 for RHEL 9	0:3.14.0-1.el9ai ~ *	`cpe:/a:redhat:enterprise_linux_ai:3.5::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787860580 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787772157 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.2	1787884873 ~ *	`cpe:/a:redhat:ai_inference_server:3.2::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789508287 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789502493 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789504371 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat AI Inference Server 3.3	1789582776 ~ *	`cpe:/a:redhat:ai_inference_server:3.3::el9`
Red Hat	Red Hat Hardened Images	3.14.0-0.1.hum1 ~ *	`cpe:/a:redhat:hummingbird:1`
Red Hat	Red Hat OpenShift AI 3.3	1789137552 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137636 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137548 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137641 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137607 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.3	1789137636 ~ *	`cpe:/a:redhat:openshift_ai:3.3::el9`
Red Hat	Red Hat OpenShift AI 3.4	1786611800 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787076778 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787077779 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1787076481 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197680 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197530 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197632 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197747 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197549 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788199622 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`
Red Hat	Red Hat OpenShift AI 3.4	1788197744 ~ *	`cpe:/a:redhat:openshift_ai:3.4::el9`

II. Public POCs for CVE-2026-56210

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-56210

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-56210 (2)

Vendor Advisories for CVE-2026-56210 (38)

🔗 2490801 – (CVE-2026-56210) CVE-2026-56210 libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id Read full article issue-tracking x_refsource_REDHAT
🔗 RHSA-2026:51146 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:60520 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:30814 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71394 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69934 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61628 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68708 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69932 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68640 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68697 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69931 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:42875 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71397 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71395 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71401 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68699 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69933 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71392 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68634 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68696 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61629 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71398 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71396 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68639 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68698 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71399 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69930 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:71393 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68637 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68638 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69935 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69929 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:61627 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:51100 - Security Advisory - Red Hat Customer Portal Read full article vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68709 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:68710 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT
🔗 RHSA-2026:69927 - Security Advisory - Red Hat Customer Portal vendor-advisory x_refsource_REDHAT

Other References for CVE-2026-56210 (1)

https://access.redhat.com/security/cve/CVE-2026-56210 vdb-entry x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-56210

Same Patch Batch · Red Hat · 2026-06-19 · 6 CVEs total

CVE-2026-56208	7.6 HIGH	Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
CVE-2026-56209	7.1 HIGH	Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map p
CVE-2026-56211	7.1 HIGH	Libaom: libaom: remote code execution via svc layer context handling with attacker-control
CVE-2026-12706	6.5 MEDIUM	Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move()
CVE-2026-12726	6.3 MEDIUM	Awx: automation-controller: awx: github webhook second-order ssrf via unvalidated statuses

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux AI 3.3 for RHEL 9

Same vendor: Red Hat

Same weakness: CWE-125

V. Comments for CVE-2026-56210

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-56210— Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 66

I. Basic Information for CVE-2026-56210

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-56210

III. Intelligence Information for CVE-2026-56210

Patches & Fixes for CVE-2026-56210 (2)

Vendor Advisories for CVE-2026-56210 (38)

Other References for CVE-2026-56210 (1)

Same Patch Batch · Red Hat · 2026-06-19 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-56210

Leave a comment