Bug#1140428: marked as done (aom: CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211)

This is a multi-part message in MIME format...

------------=_1785478021-324457-0
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"

Your message dated Fri, 31 Jul 2026 06:04:24 +0000
with message-id <[email protected]>
and subject line Bug#1140428: fixed in aom 3.14.1-1
has caused the Debian Bug report #1140428,
regarding aom: CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)


--=20
1140428: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1140428
Debian Bug Tracking System
Contact [email protected] with problems

------------=_1785478021-324457-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at submit) by bugs.debian.org; 20 Jun 2026 08:38:58 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.0 required=4.0 tests=BAYES_00,FROMDEVELOPER,
	NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 37; hammy, 150; neutral, 130; spammy,
	0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
	0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug,
	0.000-+--H*Ad:N*Tracking
Return-path: <[email protected]>
Received: via submission
	by buxtehude.debian.org with esmtp (Exim 4.96)
	(envelope-from <[email protected]>)
	id 1warE9-0098uw-09
	for [email protected];
	Sat, 20 Jun 2026 08:38:58 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Salvatore Bonaccorso <[email protected]>
To: Debian Bug Tracking System <[email protected]>
Subject: aom: CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211
Message-ID: <[email protected]>
X-Mailer: reportbug 13.2.0
Date: Sat, 20 Jun 2026 10:38:55 +0200
Delivered-To: [email protected]

Source: aom
Version: 3.13.1-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for aom.

CVE-2026-56208[0]:
| A heap buffer overflow vulnerability was found in libaom, the
| reference AV1 codec implementation. A flaw in the AV1 encoder's
| Look-Ahead Processing (LAP) mode causes the first-pass stats ring
| buffer wrap-around guard to be bypassed when g_lag_in_frames is set
| to 1 or higher. This results in a 232-byte out-of-bounds write on
| every encoded frame after the second, corrupting adjacent heap
| objects. An attacker who can influence encoder configuration in a
| transcoding service or WebRTC session could exploit this to cause a
| denial of service (process crash) or potentially achieve code
| execution.


CVE-2026-56209[1]:
| An arbitrary address write vulnerability was found in libaom, the
| reference AV1 codec implementation. A missing bounds check in the
| SVC (Scalable Video Coding) layer ID control function allows an
| attacker to inject an arbitrary pointer into the cyclic refresh map
| field via crafted image pixel values. The encoder then writes
| approximately 1,200 bytes at the attacker-controlled address. This
| is fully deterministic and does not require a separate information
| leak. An attacker who can supply frames to a network-facing libaom
| encoder with SVC enabled could exploit this for denial of service or
| potential code execution.


CVE-2026-56210[2]:
| A heap-buffer-overflow read vulnerability was found in libaom, the
| reference AV1 codec implementation. A missing bounds check in the
| SVC (Scalable Video Coding) layer ID control function allows setting
| a spatial_layer_id exceeding the configured number of layers. This
| causes an out-of-bounds heap read of approximately 40,728 bytes when
| computing a layer context array index. An attacker who can influence
| SVC encoder parameters in a network-facing service could exploit
| this for information disclosure (heap content leak) or denial of
| service (segmentation fault from hitting unmapped memory).


CVE-2026-56211[3]:
| A remote code execution vulnerability was found in libaom, the
| reference AV1 codec implementation. Insufficient bounds validation
| in the AV1 encoder's SVC (Scalable Video Coding) layer ID control
| allows an attacker to supply crafted video frame pixels that overlap
| with internal encoder layer context structures. In fork-based video
| processing services, an attacker can use this to hijack the cyclic
| refresh map pointer, brute-force the process base address via a
| crash oracle, and redirect control flow to achieve arbitrary command
| execution. Exploitation requires the target service to use libaom
| with SVC encoding enabled and accept attacker-supplied video frames.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-56208
    https://www.cve.org/CVERecord?id=CVE-2026-56208
[1] https://security-tracker.debian.org/tracker/CVE-2026-56209
    https://www.cve.org/CVERecord?id=CVE-2026-56209
[2] https://security-tracker.debian.org/tracker/CVE-2026-56210
    https://www.cve.org/CVERecord?id=CVE-2026-56210
[3] https://security-tracker.debian.org/tracker/CVE-2026-56211
    https://www.cve.org/CVERecord?id=CVE-2026-56211

Regards,
Salvatore

------------=_1785478021-324457-0
Content-Type: message/rfc822
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

Received: (at 1140428-close) by bugs.debian.org; 31 Jul 2026 06:04:26 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
	(2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD,
	HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST
	autolearn=ham autolearn_force=no
	version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 109; hammy, 150; neutral, 128; spammy,
	0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK,
	0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload,
	0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo.
Return-path: <[email protected]>
Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:58892)
	by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wpgM6-001MCu-0j
	for [email protected];
	Fri, 31 Jul 2026 06:04:26 +0000
Received: via submission
	from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified)
	by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
	(Exim 4.96)
	(envelope-from <[email protected]>)
	id 1wpgM5-00DYQV-1q
	for [email protected];
	Fri, 31 Jul 2026 06:04:25 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
	d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type:
	Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID
	:Content-Description:In-Reply-To:References;
	bh=T7+bp04rdNWRgYBHAuiCoiTWjFr68FEoDn7nbpCpNzQ=; b=cQ05D1p3DKKrdrLen5FGZPyvx0
	uXaWpP+vgXF+z8j4+4PRo3ks0lseiuS+XwvnlPEPvCnHrL463v6yJjKnP8ozr7bRb+73pyp5sMDm+
	n4KOg+hezgv1bimHs8LP7XJ/JzwnlUiU6PazO6GKXeFbU9clbs0dVPLTcsQO8yZTurdSTPmk3LfrM
	LKXioJ0turP17ZI4OVdHjgcHFIPNP60F0/RSBY3jxQHF8ZXXPN/I8HySpHaUP3VFZYQHis3zn/HTz
	Z9/FcCLV3vWwjCkhA+t8YNrpIz1jvizvyVXKA1+1BJ7M26oYjJ5s6MHLAem5bdO2glKbq89UlC7rI
	YQEIAEMw==;
Received: from dak by fasolo.debian.org with local (Exim 4.98.2)
	(envelope-from <[email protected]>)
	id 1wpgM4-00000009NvE-36Yg;
	Fri, 31 Jul 2026 06:04:24 +0000
From: Debian FTP Masters <[email protected]>
Reply-To: Samuel Henrique <[email protected]>
To: [email protected]
X-DAK: dak process-upload
X-Debian: DAK
X-Debian-Package: aom
Debian: DAK
Debian-Changes: aom_3.14.1-1_source.changes
Debian-Source: aom
Debian-Version: 3.14.1-1
Debian-Architecture: source
Debian-Suite: unstable
Debian-Archive-Action: accept
MIME-Version: 1.0
Subject: Bug#1140428: fixed in aom 3.14.1-1
Content-Type: multipart/signed; micalg="pgp-sha256";
 protocol="application/pgp-signature";
 boundary="===============4976597454485286090=="
Message-Id: <[email protected]>
Date: Fri, 31 Jul 2026 06:04:24 +0000

--===============4976597454485286090==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Source: aom
Source-Version: 3.14.1-1
Done: Samuel Henrique <[email protected]>

We believe that the bug you reported is fixed in the latest version of
aom, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Samuel Henrique <[email protected]> (supplier of updated aom package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 30 Jul 2026 22:43:51 -0700
Source: aom
Architecture: source
Version: 3.14.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Multimedia Maintainers <[email protected]>
Changed-By: Samuel Henrique <[email protected]>
Closes: 1140428
Changes:
 aom (3.14.1-1) unstable; urgency=3Dmedium
 .
   * Team upload
   * New upstream version 3.14.1 (closes: #1140428)
     - Fix CVE-2026-56208
     - Fix CVE-2026-56209
     - Fix CVE-2026-56210
     - Fix CVE-2026-56211
   * Refresh patches, no functional changes
   * d/libaom3.symbols: New symbol om_rb_read_unsigned_literal
Checksums-Sha1:
 418f7ce22add68f71ea1d03bc7bc346b8ded3a6c 2552 aom_3.14.1-1.dsc
 3193cd5af40938f931d1729dd86bb0417b1bdba4 4468480 aom_3.14.1.orig.tar.xz
 5c1942fb3e0cd2506d2db21cc3fef55189954f2a 20980 aom_3.14.1-1.debian.tar.xz
 b2f19dba7213b93fe441c4ae42676a1054ca42b1 13814 aom_3.14.1-1_amd64.buildinfo
Checksums-Sha256:
 28c4dc49ae07e9dd00f09be68844011e49d3645d203a8bc102166ccead229798 2552 aom_3.=
14.1-1.dsc
 4ef9882eda023582499511b845f4d4368a34c9886f545a7eea4ca20799d3c161 4468480 aom=
_3.14.1.orig.tar.xz
 cdf7a6ad067fa4e7fe34a937bf9fa01409d9772dfe8884f0ae6dcffb72fd6c23 20980 aom_3=
.14.1-1.debian.tar.xz
 8dcf18dcc16a3fb781b3661875e8e7c7dd9fec2c5e7c56d2c736285d9e6d4f58 13814 aom_3=
.14.1-1_amd64.buildinfo
Files:
 f2d0825ae9fc9ac5a7c7e75ee544ce22 2552 video optional aom_3.14.1-1.dsc
 55f61911c7499e30ac1ed0fc879d8c9b 4468480 video optional aom_3.14.1.orig.tar.=
xz
 f395def4d56db2c557376d46880a2e62 20980 video optional aom_3.14.1-1.debian.ta=
r.xz
 e8c89dd86c2f4961ce0d696409e88eaa 13814 video optional aom_3.14.1-1_amd64.bui=
ldinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBdtqg34QX0sdAsVfu6n6rcz7RwcFAmpsN/oACgkQu6n6rcz7
Rwcx7Q/+MTy3bzckJrbVfJaPS0srqlVnZqCLaYQSBpvHsk+jZNu2GA9ErPKFpzKq
spKwCcKxDGV3L4DVBguh2jyOL9Q3nE0Xozx35+JsBLilzgt911YaCEEAvcGvKyr4
H9D5hqJOQH2f2wM7Yjg+1TbGilM1VDND3jKcvtYa1vE2d102gFzj8FMacbkpFPq0
F0Noh7/T4lUfnqOV55Q3ozKRqJc/PzMsDqvfX/j1TD6S9d1zyzOe+Yws/wf0Kazl
fOZWddvyJkyZlacIKrZNEudeqq687jjVwZd4PUCvGIu5IYKzPp7p/YPsKUnfk3xU
/Bl6+m20AVzESIfbiP3/bZppXsm2pMH6Y2FXivffPceDM0EERoBbyrvYhxVngghJ
xsvhh9BJfQCBLwojvecSec6wUUrFK6edAGx3uvoJF8DubRjZYHGlA6pb3+JkIPTm
n2kQPBW83BfeA+QUiIA5aoU7MNxVlMo32roG5pXml0pyXi7ImweyH3NsqE2Z1qTo
M8h+NNxI2efr4LljSuwIt4qlX12mgG9XET7AFEHVsbLbmqYr5fkQ+FyI8SbdLVfs
KXr/kLfD0y0NL0Itpvxp1c6AiXkaWOFEbG2Rm7r87ZH8UcuMQBel49QzMun2/JlC
V1YvJshjaFGUfKPHYFmtambU+886NAyMAp9OBpMrR3B8i+aYWaE=3D
=3DHWGu
-----END PGP SIGNATURE-----


--===============4976597454485286090==
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCamw66AAKCRCb9qggYcy5
ISr7AQDoiYVKxpE5X1p5jRgZLp+556R4UrDczXz/kfYMGiXpsAEAswJGoLrcI/4w
nHqUmTzbxkQ1jQN1g1SlBe7zl1QC8wE=
=5XfD
-----END PGP SIGNATURE-----

--===============4976597454485286090==--
------------=_1785478021-324457-0--