A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51100 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:51146 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6411 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6411-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     August 05, 2026                       https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : aom     CVE ID         : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211     Debian Bug     : 1140428

    Multiple vulnerabilities were discovered in aom, the reference     implementation of the AV1 video codec. All of them affect the encoder;
    applications that only decode AV1 video are not affected.

    CVE-2026-56208

        In look-ahead processing (LAP) mode the first-pass statistics buffer         was sized from the configured lag-in-frames alone, leaving it shorter         than the longest group of pictures the encoder may analyse. Together         with an off-by-one in the number of frames considered, this allowed         the encoder to read and write outside the allocation, resulting in         denial of service or potentially the execution of arbitrary code.

    CVE-2026-56209, CVE-2026-56210, CVE-2026-56211

        The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec         controls did not validate the supplied scalable video coding (SVC)         layer identifiers against the number of layers actually configured.
        A negative or too large identifier led to an out-of-bounds read of         the layer context array, an out-of-bounds write through the cyclic         refresh map pointer, and potentially the execution of arbitrary         code. Exploitation requires an application that allows an attacker         to influence the encoder's SVC configuration.

    Additionally this update validates the configured number of spatial and     temporal layers, which the affected version accepted without any range     check.

    For the stable distribution (trixie), these problems have been fixed in     version 3.12.1-1+deb13u1.

    We recommend that you upgrade your aom packages.

    For the detailed security status of aom please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/aom

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3224-1 advisory.

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash       (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write       (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

    Bug fixes:

    - Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42875 advisory.

    RPM packages are internal build artifacts and not supported on their own. They are only supported as part     of the Red Hat AI application platform.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1928 advisory.

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12289)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12290)

    Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12291)

    Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12292)

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12294)

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12295)

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12296)

    Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12297)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12298)

    JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox     ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12299)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12302)

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox     152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12304)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12305)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12306)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12307)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12308)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12309)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12310)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12311)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12312)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12313)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12314)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12315)

    Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12324)

    Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12325)

    Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12327)

    Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151     and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed     in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12328)

    Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and     Thunderbird 140.12. (CVE-2026-12329)

    Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in     Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. (CVE-2026-12330)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur, (CVE-2026-50219)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation). (CVE-2026-56131)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across parsers.
    (CVE-2026-56132)

    A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw     in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around     guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds     write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can     influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a     denial of service (process crash) or potentially achieve code execution. (CVE-2026-56208)

    A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A     missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a     spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of     approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC     encoder parameters in a network-facing service could exploit this for information disclosure (heap content     leak) or denial of service (segmentation fault from hitting unmapped memory). (CVE-2026-56210)

    A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
    Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an     attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures.
    In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map     pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve     arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding     enabled and accept attacker-supplied video frames. (CVE-2026-56211)

    libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

    libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)

    libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse. (CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen. (CVE-2026-56407)

    libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2829-1 advisory.

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of firefox installed on the remote host is prior to 140.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-062 advisory.

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12289)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12290)

    Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12291)

    Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12292)

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12294)

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12295)

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12296)

    Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12297)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12298)

    JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox     ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12299)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12302)

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox     152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12304)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12305)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12306)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12307)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12308)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12309)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12310)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12311)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12312)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12313)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12314)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12315)

    Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12324)

    Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12325)

    Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12327)

    Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151     and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed     in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12328)

    Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and     Thunderbird 140.12. (CVE-2026-12329)

    Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in     Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. (CVE-2026-12330)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur, (CVE-2026-50219)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation). (CVE-2026-56131)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across parsers.
    (CVE-2026-56132)

    A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw     in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around     guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds     write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can     influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a     denial of service (process crash) or potentially achieve code execution. (CVE-2026-56208)

    A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A     missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a     spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of     approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC     encoder parameters in a network-facing service could exploit this for information disclosure (heap content     leak) or denial of service (segmentation fault from hitting unmapped memory). (CVE-2026-56210)

    A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
    Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an     attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures.
    In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map     pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve     arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding     enabled and accept attacker-supplied video frames. (CVE-2026-56211)

    libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

    libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)

    libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse. (CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen. (CVE-2026-56407)

    libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of thunderbird installed on the remote host is prior to 140.12.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3795 advisory.

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12289)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12290)

    Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12292)

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12294)

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12295)

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12296)

    Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12297)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12298)

    JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox     ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12299)

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox     152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12304)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12305)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12306)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12307)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12308)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12309)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12310)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12312)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12313)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12314)

    Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12324)

    Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12325)

    Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12327)

    Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151     and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed     in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12328)

    Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and     Thunderbird 140.12. (CVE-2026-12329)

    Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in     Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. (CVE-2026-12330)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur, (CVE-2026-50219)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation). (CVE-2026-56131)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across parsers.
    (CVE-2026-56132)

    A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw     in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around     guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds     write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can     influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a     denial of service (process crash) or potentially achieve code execution. (CVE-2026-56208)

    A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A     missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a     spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of     approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC     encoder parameters in a network-facing service could exploit this for information disclosure (heap content     leak) or denial of service (segmentation fault from hitting unmapped memory). (CVE-2026-56210)

    A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
    Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an     attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures.
    In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map     pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve     arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding     enabled and accept attacker-supplied video frames. (CVE-2026-56211)

    libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

    libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)

    libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse. (CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen. (CVE-2026-56407)

    libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21061-1 advisory.

    This update for libaom fixes the following issues

    - CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a     process crash       (bsc#1268650).
    - CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory     write       (bsc#1268651).
    - CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read     (bsc#1268653).
    - CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution     (bsc#1268655).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
    Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an     attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures.
    In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map     pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve     arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding     enabled and accept attacker-supplied video frames. (CVE-2026-56211)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333169	RHEL 9 : RHEL AI 3.3 RPM runtime CVE fix - aom (Important) (RHSA-2026:51100)	Nessus	Red Hat Local Security Checks	Local	high
333121	RHEL 9 : RHEL AI 3.4 RPM runtime CVE fix - aom (Important) (RHSA-2026:51146)	Nessus	Red Hat Local Security Checks	Local	high
332088	Debian dsa-6411 : aom-tools - security update	Nessus	Debian Local Security Checks	Local	high
329507	SUSE SLED15: aom-tools / libSvtAv1Enc1 / libaom-devel / libaom-devel-doc / etc (SUSE-SU-2026:3224-1)	Nessus	SuSE Local Security Checks	Local	high
328800	RHEL 9 : RHEL AI 3.5 RPM runtime CVE fix - aom (Important) (RHSA-2026:42875)	Nessus	Red Hat Local Security Checks	Local	high
327385	Amazon Linux 2023 : firefox (ALAS2023-2026-1928)	Nessus	Amazon Linux Local Security Checks	Local	medium
326330	SUSE SLES15 Security Update : libaom (SUSE-SU-2026:2829-1)	Nessus	SuSE Local Security Checks	Local	high
325581	Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2026-062 (ALASFIREFOX-2026-062)	Nessus	Amazon Linux Local Security Checks	Local	medium
325578	Amazon Linux 2 : thunderbird, --advisory ALAS2-2026-3795 (ALAS-2026-3795)	Nessus	Amazon Linux Local Security Checks	Local	medium
324060	openSUSE 16 Security Update : libaom (openSUSE-SU-2026:21061-1)	Nessus	SuSE Local Security Checks	Local	high
321806	Linux Distros Unpatched Vulnerability : CVE-2026-56211	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-56211

high

Tenable Plugins

high

high

high

high

high

medium

high

medium

medium

high

high