Home / mailings [SECURITY] [DSA 6411-1] aom security update
Posted on 05 August 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6411-1 security@debian.org
https://www.debian.org/security/ Aron Xu
August 05, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : aom
CVE ID : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211
Debian Bug : 1140428
Multiple vulnerabilities were discovered in aom, the reference
implementation of the AV1 video codec. All of them affect the encoder;
applications that only decode AV1 video are not affected.
CVE-2026-56208
In look-ahead processing (LAP) mode the first-pass statistics buffer
was sized from the configured lag-in-frames alone, leaving it shorter
than the longest group of pictures the encoder may analyse. Together
with an off-by-one in the number of frames considered, this allowed
the encoder to read and write outside the allocation, resulting in
denial of service or potentially the execution of arbitrary code.
CVE-2026-56209, CVE-2026-56210, CVE-2026-56211
The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec
controls did not validate the supplied scalable video coding (SVC)
layer identifiers against the number of layers actually configured.
A negative or too large identifier led to an out-of-bounds read of
the layer context array, an out-of-bounds write through the cyclic
refresh map pointer, and potentially the execution of arbitrary
code. Exploitation requires an application that allows an attacker
to influence the encoder's SVC configuration.
Additionally this update validates the configured number of spatial and
temporal layers, which the affected version accepted without any range
check.
For the stable distribution (trixie), these problems have been fixed in
version 3.12.1-1+deb13u1.
We recommend that you upgrade your aom packages.
For the detailed security status of aom please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/aom
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
