{"id":"CVE-2026-56210","title":"A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation","summary":"A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the co…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","cwe":["CWE-125"],"vendor":"Red Hat","product":"aom","affected":["aom (all versions)","aom (all versions)","aom (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/model-opt-cuda-rhel9 (all versions)","rhaiis/vllm-spyre-rhel9 (all versions)","rhaiis/vllm-rocm-rhel9 (all versions)","rhaiis/vllm-cuda-rhel9 (all versions)","rhelai3/bootc-aws-cuda-rhel9 (all versions)","rhelai3/bootc-azure-cuda-rhel9 (all versions)","rhelai3/bootc-azure-rocm-rhel9 (all versions)","rhelai3/bootc-cuda-rhel9 (all versions)","rhelai3/bootc-gcp-cuda-rhel9 (all versions)","rhelai3/bootc-rocm-rhel9 (all versions)","rhelai3/disk-image-cuda-rhel9 (all versions)","aom-main (all versions)","rhai/base-image-neuron-rhel9 (all versions)","rhai/base-image-rocm-7.0-rhel9 (all versions)","rhai/base-image-cuda-13.0-rhel9 (all versions)","rhai/base-image-tpu-rhel9 (all versions)","rhai/base-image-rocm-6.4-rhel9 (all versions)","rhai/base-image-cpu-rhel9 (all versions)","rhai/base-image-spyre-rhel9 (all versions)","rhai/base-image-cuda-12.9-rhel9 (all versions)","rhoai/odh-mlserver-rhel9 (all versions)","rhoai/odh-th06-cpu-torch210-py312-rhel9 (all versions)","rhoai/odh-th06-cuda130-torch210-py312-rhel9 (all versions)","rhoai/odh-th06-rocm64-torch291-py312-rhel9 (all versions)","rhai/base-image-tpu-rhel9 (all versions)","rhai/base-image-cpu-rhel9 (all versions)","rhai/base-image-gaudi-rhel9 (all versions)","rhai/base-image-spyre-rhel9 (all versions)","rhai/base-image-rocm-7.1-rhel9 (all versions)","rhai/base-image-cuda-12.9-rhel9 (all versions)","rhai/base-image-cuda-13.0-rhel9 (all versions)","rhai/base-image-rocm-6.4-rhel9 (all versions)","rhai/base-image-neuron-rhel9 (all versions)","rhai/base-image-cpu-rhel9 (all versions)","rhai/base-image-tpu-rhel9 (all versions)","rhai/base-image-gaudi-rhel9 (all versions)","rhai/base-image-cuda-13.0-rhel9 (all versions)","rhai/base-image-rubin-rhel9 (all versions)","rhai/base-image-spyre-rhel9 (all versions)","rhai/base-image-cuda-12.9-rhel9 (all versions)","rhai/base-image-rocm-7.14-rhel9 (all versions)","rhai/base-image-gaudi-rhel9 (all versions)","rhai/base-image-cpu-rhel9 (all versions)","rhai/base-image-neuron-rhel9 (all versions)"],"patched":["enterprise_linux_ai_3_3_for_rhel 9","enterprise_linux_ai_3_4_for_rhel 9","enterprise_linux_ai_3_5_for_rhel 9","ai_inference_server 3.2","ai_inference_server 3.3","hardened_images","openshift_ai 3.3","openshift_ai 3.4"],"published":"2026-06-19","updated":"2026-10-09","sourceUpdated":"2026-10-09T18:17:10.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56210","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:30814","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42875","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:51100","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:51146","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68634","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68637","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68638","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68639","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68640","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68696","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68697","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68698","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68699","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68708","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68709","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:68710","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69927","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69929","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69930","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69931","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69932","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69933","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69934","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:69935","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71392","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71393","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71394","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71395","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71396","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71397","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71398","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71399","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:71401","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:74771","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75652","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75654","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75657","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75658","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75659","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:75660","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:76041","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:76042","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:76043","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56210","label":"secalert@redhat.com"},{"url":"https://aomedia.googlesource.com/aom/+/a93ba0ffaa","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490801","label":"secalert@redhat.com"},{"url":"https://issues.chromium.org/issues/503975732","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:30814","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42875","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51100","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51146","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61627","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61628","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:61629","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-56210","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490801","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56210"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56210"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734","label":"RHSA-2026:84734"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00578,"epssPercentile":0.47419,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-06-22T18:22:57.799192Z"},"ingestedAt":"2026-06-29T13:42:11.975Z","slug":"CVE-2026-56210","body":"## Overview\n\nA heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:51100** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51100)\n- **RHSA-2026:51146** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.4 for RHEL 9 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51146)\n- **RHSA-2026:42875** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.5 for RHEL 9 · released 2026-07-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:42875)\n- **RHSA-2026:61628** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61628)\n- **RHSA-2026:61627** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61627)\n- **RHSA-2026:61629** · Red Hat · fixed in: Red Hat AI Inference Server 3.2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61629)\n- **RHSA-2026:68696** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68696)\n- **RHSA-2026:68699** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68699)\n- **RHSA-2026:68698** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68698)\n- **RHSA-2026:68697** · Red Hat · fixed in: Red Hat AI Inference Server 3.3 · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68697)\n- **RHSA-2026:30814** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:30814)\n- **Red Hat VEX** · Important · affected: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat AI Inference Server, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56210.json)\n- **RHSA-2026:76041** · Red Hat · fixed in: Red Hat Enterprise Linux AI 3.3 · released 2026-10-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:76041)","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}