CVE-2026-56209: Libaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijack

Synopsis

An arbitrary address write vulnerability exists in libaom, the reference AV1 codec library. The flaw is reachable over the network with no authentication required, exploitable by supplying crafted AV1-encoded frames to a network-facing encoder with Scalable Video Coding (SVC) enabled; a missing bounds check lets the attacker inject a pointer into the cyclic refresh map field, after which the encoder writes roughly 1,200 bytes at that attacker-controlled address. Successful exploitation causes denial of service or enables code execution. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix lands.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to deliver crafted AV1 frames to a network-exposed libaom encoder, making over-the-network reachability a prerequisite.

• AuthenticationNot required

  The CVSS vector specifies PR:N, meaning no account or credential of any privilege level is needed to supply malicious frames.

• Victim interactionNot required

  The CVSS vector specifies UI:N; exploitation is fully automated once the attacker can submit frames and requires no action from a user or operator.

• Attack complexityDetail

  The CVSS vector specifies AC:L; the exploit is fully deterministic, requires no information leak, and imposes no race-condition or memory-layout constraints on the attacker.

Blast Radius

• Writes approximately 1,200 bytes to an attacker-chosen memory address inside the encoding process, corrupting heap or stack data at that location.
• Crashes the libaom encoder process, disrupting any service that depends on AV1 encoding (denial of service).
• With a suitable target address, overwrites function pointers or control structures in a way that redirects execution to attacker-supplied code (remote code execution within the process).
• The CVSS confidentiality score is N, so direct data disclosure is not part of this exploit path; impact is limited to integrity corruption and availability loss.