Detections
Analytics

Echo: aom: security update to 3.12.1-1+e2

high Tenable Self-Hosted Container Security Plugin ID 461319

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A
 missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to
 inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder
 then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and
 does not require a separate information leak. An attacker who can supply frames to a network-facing libaom
 encoder with SVC enabled could exploit this for denial of service or potential code execution.
 (CVE-2026-56209)

Solution

Update the aom library and its related packages to version 3.12.1-1+e2 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-56209

Plugin Details

Severity: High

ID: 461319

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 52.02

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:C/A:C

CVSS Score Source: CVE-2026-56209

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/20/2026

Vulnerability Publication Date: 6/19/2026

Reference Information

CVE: CVE-2026-56209