RCE via AV1 SVC ID Bounds in libaom Encoder
CVE-2026-56211 Published on June 19, 2026
Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
Vulnerability Analysis
CVE-2026-56211 can be exploited with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity and availability.
Timeline
Reported to Red Hat.
Made public.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-56211 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-56211
Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.
