CVE-2026-56210

Name	CVE-2026-56210
Description	A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140428

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
aom (PTS)	bullseye	1.0.0.errata1-3+deb11u1	fixed
	bullseye (security)	1.0.0.errata1-3+deb11u2	fixed
	bookworm	3.6.0-1+deb12u2	vulnerable
	bookworm (security)	3.6.0-1+deb12u1	vulnerable
	trixie	3.12.1-1	vulnerable
	forky, sid	3.13.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
aom	source	bullseye	(not affected)
aom	source	(unstable)	(unfixed)			1140428

Notes

[bullseye] - aom <not-affected> (1.0.0 lacks the SVC encoder layer_context array, introduced in 2.0.0)
https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d
https://bugzilla.redhat.com/show_bug.cgi?id=2490801
https://issues.chromium.org/issues/503975732