CVE-2026-56211— Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

跨界内存写

AOMedia libaom 缓冲区错误漏洞

AOMedia libaom是AOMedia组织开源的一个视频编码库。 AOMedia libaom存在缓冲区错误漏洞，该漏洞源于AV1编码器的SVC层ID控制中边界验证不足，允许攻击者将特制视频帧像素与内部编码器层上下文结构重叠，进而劫持循环刷新映射指针并通过崩溃预言暴力破解进程基地址以重定向控制流执行任意远程代码。

N/A

N/A