CVE record · CVE-2026-56208

Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode

CVSS 7.6 HighEPSS 0.0062 · 50th percentile

Published by the CVE Program (CNA: redhat) at 19 Jun 2026, 16:28 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el10_0 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el7_9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_10 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el8_8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el9_8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el9_2 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el9_4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support Package name: firefox https://access.redhat.com/downloads/content/package-browser/	unaffected 0:140.13.0-1.el9_6 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 for RHEL 9 Package name: aom https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.14.0-1.el9ai to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.4 for RHEL 9 Package name: aom https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.14.0-1.el9ai to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.5 for RHEL 9 Package name: aom https://access.redhat.com/downloads/content/package-browser/	unaffected 0:3.14.0-1.el9ai to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.2 Package name: rhaiis/vllm-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1787860580 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.2 Package name: rhaiis/model-opt-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1787772157 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.2 Package name: rhaiis/vllm-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1787884873 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/model-opt-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789508287 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-spyre-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789502493 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789504371 to before * rpm Other versions: affected
Red Hat	Red Hat AI Inference Server 3.3 Package name: rhaiis/vllm-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789582776 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-aws-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790936334 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-azure-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790936351 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-azure-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790850900 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790866732 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-gcp-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790936334 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/bootc-rocm-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790791893 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux AI 3.3 Package name: rhelai3/disk-image-cuda-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1790954179 to before * rpm Other versions: affected
Red Hat	Red Hat Hardened Images Package name: aom-main https://catalog.redhat.com/software/containers/	unaffected 3.14.0-0.1.hum1 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-neuron-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137552 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-rocm-7.0-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137548 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-cuda-13.0-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137636 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-tpu-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137548 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-rocm-6.4-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137548 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-cpu-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137641 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-spyre-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137607 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.3 Package name: rhai/base-image-cuda-12.9-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1789137636 to before * rpm Other versions: affected
Red Hat	Red Hat OpenShift AI 3.4 Package name: rhoai/odh-mlserver-rhel9 https://catalog.redhat.com/software/containers/	unaffected 1786611800 to before * rpm Other versions: affected

And 58 more products. The full list is on the CVE record.

Identifiers: CVE-2026-56208
CNA: redhat
Weakness (CWE): CWE-122
Tags: Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Memory corruption
Published: 19 Jun 2026
Updated: 4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
7.6	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H	CNA (redhat)Used for this record
7.6	High	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H	ADP (redhat-SADP)

CISA KEV Not listed.
EPSS 0.0062, the 50th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

19 Jun 2026, 16:28 UTC Confirmed by the CVE List
19 Jun 2026, 17:16 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2026:30814 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:42875 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:47104 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:47105 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:51100 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:51146 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54180 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54181 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54182 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54185 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54248 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54249 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54259 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:54339 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:60520 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:61627 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:61628 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:61629 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68634 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68637 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68638 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68639 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68640 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68696 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68697 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68698 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68699 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68708 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68709 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2026:68710 vendor-advisoryredhat

And 32 more on the CVE record.

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.