CVE-2026-56209

Name of the Vulnerable Software and Affected Versions libaom (affected versions not specified)

Description An arbitrary address write issue exists in the reference AV1 codec implementation. A missing bounds check in the Scalable Video Coding (SVC) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field by using crafted image pixel values. Consequently, the encoder writes approximately 1,200 bytes to an address controlled by the attacker. This process is fully deterministic and does not require a separate information leak. An attacker providing frames to a network-facing encoder with SVC enabled could cause a denial of service or achieve potential code execution.

Recommendations Apply the aomedia patched build (commit a93ba0ffaa) or a vendor update. As a temporary mitigation, disable SVC in the libaom encoder.