Answer in brief
CVE-2026-56208 records a High severity (CVSS 7.6) vulnerability in Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode. The current sources do not mark it as known exploited. The current feed maps Red Hat/firefox (generic), Red Hat/rhai/base-image-cpu-rhel9 (generic), Red Hat/rhai/base-image-cuda-12.9-rhel9 (generic), Red Hat/rhai/base-image-cuda-13.0-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.6. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/firefox (generic), Red Hat/rhai/base-image-cpu-rhel9 (generic), Red Hat/rhai/base-image-cuda-12.9-rhel9 (generic), Red Hat/rhai/base-image-cuda-13.0-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/firefoxgeneric | * | Not reported |
| Red Hat/rhai/base-image-cpu-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-cuda-12.9-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-cuda-13.0-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-gaudi-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-neuron-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-6.4-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-7.0-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-7.1-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-spyre-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-tpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/model-opt-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/model-opt-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-cpu-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-neuron-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-rocm-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-spyre-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-tpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-cpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-gaudi-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-neuron-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-rocm-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-spyre-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-tpu-rhel9generic | * | Not reported |
| Red Hat/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9generic | * | Not reported |
| Red Hat/thunderbirdgeneric | * | Not reported |
Published upstream
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
Quoted source text, attributed separately from HOL analysis.