USN-8772-1: AOM vulnerabilities
Ubuntu USN-8772-1 patches four libaom flaws (CVE-2026-56208 to CVE-2026-56211) that could cause heap overflow, arbitrary memory writes, or code execution.
Ubuntu Security Notice USN-8772-1 fixes a heap buffer overflow in libaom's first-pass statistics buffer handling in Look-Ahead Processing mode (CVE-2026-56208), potentially causing denial of service or arbitrary code execution. Three additional flaws in spatial and temporal layer ID validation in the SVC encoder controls (CVE-2026-56209, CVE-2026-56210, CVE-2026-56211) allow arbitrary memory writes, out-of-bounds heap reads, or code execution. Users should apply the updated packages.
- CVE-2026-56208: heap buffer overflow in LAP-mode first-pass statistics buffer.
- CVE-2026-56209 to CVE-2026-56211: SVC encoder layer ID validation flaws.
- Impacts range from denial of service to arbitrary code execution.
- Routine vendor notice; patch Ubuntu systems running libaom.
- Products
- libaom
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-56208 | A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation | 7.6 | <1% | ||
| CVE-2026-56209 | An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation | 7.1 | <1% | ||
| CVE-2026-56210 | libaom: A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding… | 7.1 | <1% | ||
| CVE-2026-56211 | A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation | 7.1 | <1% |
From the original article
It was discovered that AOM incorrectly handled the first-pass statistics buffer in Look-Ahead Processing (LAP) mode. An attacker could possibly use this issue to cause a heap buffer overflow, leading to a denial of service or possibly execute arbitrary code. (CVE-2026-56208) It was discovered that AOM incorrectly validated spatial and temporal layer IDs in the SVC (Scalable Video Coding) encoder controls.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.