Answer in brief
CVE-2026-56211 records a High severity (CVSS 7.1) vulnerability in Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames. The current sources do not mark it as known exploited. The current feed maps Red Hat/firefox (generic), Red Hat/rhai/base-image-cpu-rhel9 (generic), Red Hat/rhai/base-image-cuda-12.9-rhel9 (generic), Red Hat/rhai/base-image-cuda-13.0-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Red Hat/firefox (generic), Red Hat/rhai/base-image-cpu-rhel9 (generic), Red Hat/rhai/base-image-cuda-12.9-rhel9 (generic), Red Hat/rhai/base-image-cuda-13.0-rhel9 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Red Hat/firefoxgeneric | * | Not reported |
| Red Hat/rhai/base-image-cpu-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-cuda-12.9-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-cuda-13.0-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-gaudi-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-neuron-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-6.4-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-7.0-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-rocm-7.1-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-spyre-rhel9generic | * | Not reported |
| Red Hat/rhai/base-image-tpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/model-opt-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/model-opt-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-cpu-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-neuron-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-rocm-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-spyre-rhel9generic | * | Not reported |
| Red Hat/rhaiis/vllm-tpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-cpu-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-cuda-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-gaudi-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-neuron-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-rocm-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-spyre-rhel9generic | * | Not reported |
| Red Hat/rhaii/vllm-tpu-rhel9generic | * | Not reported |
| Red Hat/rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9generic | * | Not reported |
| Red Hat/thunderbirdgeneric | * | Not reported |
Published upstream
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
Quoted source text, attributed separately from HOL analysis.