An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A
    missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to
    inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder
    then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and
    does not require a separate information leak. An attacker who can supply frames to a network-facing libaom
    encoder with SVC enabled could exploit this for denial of service or potential code execution.
    (CVE-2026-56209)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8772-1 advisory.

    It was discovered that AOM incorrectly handled the first-pass statistics buffer in Look-Ahead Processing     (LAP) mode. An attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial     of service or possibly execute arbitrary code. (CVE-2026-56208)

    It was discovered that AOM incorrectly validated spatial and temporal layer IDs in the SVC (Scalable Video     Coding) encoder controls. An attacker could possibly use this issue to write to an arbitrary memory     address, read out-of-bounds heap memory, or execute arbitrary code. (CVE-2026-56209, CVE-2026-56210,     CVE-2026-56211)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4774 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4774-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Andreas Henriksson     September 06, 2026                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : aom     Version        : 3.6.0-1+deb12u3     CVE ID         : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211     Debian Bug     : 1140428

    Multiple vulnerabilities were discovered in aom, the reference     implementation of the AV1 video codec. All of them affect the encoder;
    applications that only decode AV1 video are not affected.

    CVE-2026-56208

        In look-ahead processing (LAP) mode the first-pass statistics buffer         was sized from the configured lag-in-frames alone, leaving it shorter         than the longest group of pictures the encoder may analyse. Together         with an off-by-one in the number of frames considered, this allowed         the encoder to read and write outside the allocation, resulting in         denial of service or potentially the execution of arbitrary code.

    CVE-2026-56209, CVE-2026-56210, CVE-2026-56211

        The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec         controls did not validate the supplied scalable video coding (SVC)         layer identifiers against the number of layers actually configured.
        A negative or too large identifier led to an out-of-bounds read of         the layer context array, an out-of-bounds write through the cyclic         refresh map pointer, and potentially the execution of arbitrary         code. Exploitation requires an application that allows an attacker         to influence the encoder's SVC configuration.

    Additionally this update validates the configured number of spatial and     temporal layers, which the affected version accepted without any range     check.

    For Debian 12 bookworm, these problems have been fixed in version     3.6.0-1+deb12u3.

    We recommend that you upgrade your aom packages.

    For the detailed security status of aom please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/aom

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51100 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51146 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6411 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6411-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 05, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : aom     CVE ID         : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211     Debian Bug     : 1140428

    Multiple vulnerabilities were discovered in aom, the reference     implementation of the AV1 video codec. All of them affect the encoder;
    applications that only decode AV1 video are not affected.

    CVE-2026-56208

        In look-ahead processing (LAP) mode the first-pass statistics buffer         was sized from the configured lag-in-frames alone, leaving it shorter         than the longest group of pictures the encoder may analyse. Together         with an off-by-one in the number of frames considered, this allowed         the encoder to read and write outside the allocation, resulting in         denial of service or potentially the execution of arbitrary code.

    CVE-2026-56209, CVE-2026-56210, CVE-2026-56211

        The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec         controls did not validate the supplied scalable video coding (SVC)         layer identifiers against the number of layers actually configured.
        A negative or too large identifier led to an out-of-bounds read of         the layer context array, an out-of-bounds write through the cyclic         refresh map pointer, and potentially the execution of arbitrary         code. Exploitation requires an application that allows an attacker         to influence the encoder's SVC configuration.

    Additionally this update validates the configured number of spatial and     temporal layers, which the affected version accepted without any range     check.

    For the stable distribution (trixie), these problems have been fixed in     version 3.12.1-1+deb13u1.

    We recommend that you upgrade your aom packages.

    For the detailed security status of aom please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/aom

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3224-1 advisory.

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash       (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write       (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

    Bug fixes:

    - Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42875 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2829-1 advisory.

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21061-1 advisory.

    This update for libaom fixes the following issues

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash       (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write       (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A     missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to     inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder     then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and     does not require a separate information leak. An attacker who can supply frames to a network-facing libaom     encoder with SVC enabled could exploit this for denial of service or potential code execution.
    (CVE-2026-56209)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461319	Echo: aom: security update to 3.12.1-1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
461319	Echo: aom: security update to 3.12.1-1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
346813	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : AOM vulnerabilities (USN-8772-1)	Nessus	Ubuntu Local Security Checks	Local	high
343244	Debian dla-4774 : aom-tools - security update	Nessus	Debian Local Security Checks	Local	high
333169	RHEL 9 : RHEL AI 3.3 RPM runtime CVE fix - aom (Important) (RHSA-2026:51100)	Nessus	Red Hat Local Security Checks	Local	high
333121	RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - aom (Important) (RHSA-2026:51146)	Nessus	Red Hat Local Security Checks	Local	high
332088	Debian dsa-6411 : aom-tools - security update	Nessus	Debian Local Security Checks	Local	high
329507	SUSE SLED15: aom-tools / libSvtAv1Enc1 / libaom-devel / libaom-devel-doc / etc (SUSE-SU-2026:3224-1)	Nessus	SuSE Local Security Checks	Local	high
328800	RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - aom (Important) (RHSA-2026:42875)	Nessus	Red Hat Local Security Checks	Local	high
326330	SUSE SLES15 Security Update : libaom (SUSE-SU-2026:2829-1)	Nessus	SuSE Local Security Checks	Local	high
324060	openSUSE 16 Security Update : libaom (openSUSE-SU-2026:21061-1)	Nessus	SuSE Local Security Checks	Local	high
321797	Linux Distros Unpatched Vulnerability : CVE-2026-56209	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-56209

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high