CVE-2026-56211

Name	CVE-2026-56211
Description	A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140428

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
aom (PTS)	bullseye	1.0.0.errata1-3+deb11u1	fixed
	bullseye (security)	1.0.0.errata1-3+deb11u2	fixed
	bookworm	3.6.0-1+deb12u2	vulnerable
	bookworm (security)	3.6.0-1+deb12u1	vulnerable
	trixie	3.12.1-1	vulnerable
	forky, sid	3.13.1-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
aom	source	bullseye	(not affected)
aom	source	(unstable)	(unfixed)			1140428

Notes

[bullseye] - aom <not-affected> (1.0.0 lacks the aom_svc_layer_id_t encoder control, introduced in 2.0.0)
https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d
https://bugzilla.redhat.com/show_bug.cgi?id=2490802
https://issues.chromium.org/issues/503993985