Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-56208 (GCVE-0-2026-56208)
Vulnerability from cvelistv5 – Published: 2026-06-19 16:28 – Updated: 2026-07-29 12:04
VLAI
EPSS
VEX
Title
Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode
Summary
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
Severity
7.6 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:30814 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:42875 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2026:47105 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-56208 | vdb-entryx_refsource_REDHAT |
| https://aomedia.googlesource.com/aom/+/243f8ae84b | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2490799 | issue-trackingx_refsource_REDHAT |
| https://issues.chromium.org/issues/504317456 | |
| https://security.access.redhat.com/data/csaf/v2/v… | x_sadp-csaf-vex |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:140.13.0-1.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8::appstream |
|
| Red Hat | Red Hat Enterprise Linux AI 3.5 for RHEL 9 |
Unaffected:
0:3.14.0-1.el9ai , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.5::el9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
3.14.0-0.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat AI Inference Server |
cpe:/a:redhat:ai_inference_server:3 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:140.13.0-1.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
Date Public
2026-06-19 00:00
Credits
Red Hat would like to thank The FuzzAnything Team (FuzzAnything) for reporting this issue.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-56208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-25T03:55:29.788406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-25T13:47:21.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:140.13.0-1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.5::el9"
],
"defaultStatus": "affected",
"packageName": "aom",
"product": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.14.0-1.el9ai",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "aom-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.14.0-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-gaudi-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-12.9-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-13.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-gaudi-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-neuron-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-6.4-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.1-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-spyre-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-tpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-automl-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-autorag-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlserver-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
}
],
"datePublic": "2026-06-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:04:38.316Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"name": "RHBZ#2490799",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42875: Red Hat Enterprise Linux AI 3.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:47105: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:30814: Red Hat Hardened Images"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Made public."
}
],
"title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
"workarounds": [
{
"lang": "en",
"value": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:140.13.0-1.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.5::el9"
],
"defaultStatus": "affected",
"packageName": "aom",
"product": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.14.0-1.el9ai",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "aom-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.14.0-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-gaudi-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-12.9-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-13.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-gaudi-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-neuron-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-6.4-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.1-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-spyre-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-tpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-automl-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-autorag-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlserver-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank The FuzzAnything Team (FuzzAnything) for reporting this issue."
}
],
"datePublic": "2026-06-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T23:07:24.082Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:30814",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"name": "RHSA-2026:42875",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"name": "RHSA-2026:47105",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"name": "RHBZ#2490799",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"url": "https://issues.chromium.org/issues/504317456"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-06-19T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode",
"workarounds": [
{
"lang": "en",
"value": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-56208",
"datePublished": "2026-06-19T16:28:26.466Z",
"dateReserved": "2026-06-19T15:50:16.801Z",
"dateUpdated": "2026-07-29T12:04:38.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-56208",
"date": "2026-08-01",
"epss": "0.00281",
"percentile": "0.20403"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-56208\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-06-19T17:16:30.297\",\"lastModified\":\"2026-07-29T13:19:01.870\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8::appstream\"],\"versions\":[{\"version\":\"0:140.13.0-1.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aom\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.5::el9\"],\"versions\":[{\"version\":\"0:3.14.0-1.el9ai\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"aom-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"3.14.0-0.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cuda-12.9-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cuda-13.0-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-6.4-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-7.0-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-7.1-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-automl-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-autorag-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-autogluon-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llama-stack-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llm-d-kv-cache-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlserver-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-spark-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-rocm64-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:140.13.0-1.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aom\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.5::el9\"],\"versions\":[{\"version\":\"0:3.14.0-1.el9ai\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"aom-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"3.14.0-0.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaii/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"firefox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"thunderbird\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cuda-12.9-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-cuda-13.0-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-6.4-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-7.0-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-rocm-7.1-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/base-image-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-automl-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-autorag-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-autogluon-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llama-stack-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llm-d-kv-cache-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlserver-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-spark-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-rocm64-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H\",\"baseScore\":7.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-25T03:55:29.788406Z\",\"id\":\"CVE-2026-56208\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-122\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30814\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42875\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47105\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-56208\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://aomedia.googlesource.com/aom/+/243f8ae84b\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2490799\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://issues.chromium.org/issues/504317456\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30814\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42875\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:47105\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-56208\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2490799\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-07-28T23:07:19+00:00",
"cve": "CVE-2026-56208",
"id": "CVE-2026-56208",
"initial_release_date": "2026-06-19T00:00:00+00:00",
"product_status:fixed": "45",
"product_status:known_affected": "46",
"product_status:known_not_affected": "5",
"product_status:under_investigation": "6",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-07-30T16:38:30Z",
"cve": "CVE-2026-56208",
"id": "CVE-2026-56208",
"initial_release_date": "2026-06-23T02:19:36Z",
"product_status:known_affected": "7",
"product_status:known_not_affected": "8",
"product_status:recommended": "130",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-56208",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-56208.json",
"version": "11"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:140.13.0-1.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.14.0-1.el9ai\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"aom\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"3.14.0-0.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"aom-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/model-opt-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/model-opt-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cuda-12.9-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cuda-13.0-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-6.4-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-7.0-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-7.1-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-automl-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-autorag-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-autogluon-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llama-stack-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llm-d-kv-cache-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlserver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-spark-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-rocm64-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:42875: Red Hat Enterprise Linux AI 3.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:47105: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30814: Red Hat Hardened Images\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-19T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-56208\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2490799\", \"name\": \"RHBZ#2490799\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42875\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47105\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30814\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There is no complete mitigation for this vulnerability. The following measures can reduce risk:\\n\\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\\n4. Apply network-level access controls to limit who can submit video for encoding.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-29T12:04:38.316Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-56208\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-25T03:55:29.788406Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-22T14:19:29.929Z\"}}], \"cna\": {\"title\": \"Libaom: libaom: heap buffer overflow in av1 encoder first-pass stats buffer via lap mode\", \"credits\": [{\"lang\": \"en\", \"value\": \"Red Hat would like to thank The FuzzAnything Team (FuzzAnything) for reporting this issue.\"}], \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8::appstream\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:140.13.0-1.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.14.0-1.el9ai\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"aom\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"3.14.0-0.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"aom-main\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/model-opt-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/model-opt-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaii/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"firefox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"thunderbird\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cuda-12.9-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-cuda-13.0-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-6.4-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-7.0-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-rocm-7.1-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-spyre-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhai/base-image-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-automl-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-autorag-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-autogluon-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llama-stack-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llm-d-kv-cache-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlserver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-spark-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-rocm64-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-19T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2026-06-19T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2026:30814\", \"name\": \"RHSA-2026:30814\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42875\", \"name\": \"RHSA-2026:42875\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:47105\", \"name\": \"RHSA-2026:47105\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2026-56208\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://aomedia.googlesource.com/aom/+/243f8ae84b\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2490799\", \"name\": \"RHBZ#2490799\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://issues.chromium.org/issues/504317456\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There is no complete mitigation for this vulnerability. The following measures can reduce risk:\\n\\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\\n4. Apply network-level access controls to limit who can submit video for encoding.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"Heap-based Buffer Overflow\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-07-28T23:07:24.082Z\"}, \"x_redhatCweChain\": \"CWE-122: Heap-based Buffer Overflow\"}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-56208\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T12:04:38.316Z\", \"dateReserved\": \"2026-06-19T15:50:16.801Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2026-06-19T16:28:26.466Z\", \"assignerShortName\": \"redhat\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-56208
Vulnerability from fkie_nvd - Published: 2026-06-19 17:16 - Updated: 2026-07-22 12:18
Severity
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Summary
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.5::el9"
],
"defaultStatus": "affected",
"packageName": "aom",
"product": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.14.0-1.el9ai",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "aom-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.14.0-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-gaudi-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-12.9-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-13.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-gaudi-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-neuron-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-6.4-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.1-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-spyre-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-tpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-automl-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-autorag-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlserver-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
}
],
"source": "secalert@redhat.com"
},
{
"affectedData": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.5::el9"
],
"defaultStatus": "affected",
"packageName": "aom",
"product": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.14.0-1.el9ai",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "aom-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "3.14.0-0.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-gaudi-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "firefox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unknown",
"packageName": "thunderbird",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-12.9-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-cuda-13.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-gaudi-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-neuron-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-6.4-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.0-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-rocm-7.1-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-spyre-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhai/base-image-tpu-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-automl-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-autorag-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-autogluon-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-llm-d-kv-cache-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlserver-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution."
}
],
"id": "CVE-2026-56208",
"lastModified": "2026-07-22T12:18:14.550",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 4.7,
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-56208",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-25T03:55:29.788406Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-19T17:16:30.297",
"references": [
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"source": "secalert@redhat.com",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"source": "secalert@redhat.com",
"url": "https://issues.chromium.org/issues/504317456"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "secalert@redhat.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-122"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
]
}
GHSA-MGV2-4J37-M3X6
Vulnerability from github – Published: 2026-06-19 18:32 – Updated: 2026-07-29 00:31
VLAI
Details
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
Severity
7.6 (High)
{
"affected": [],
"aliases": [
"CVE-2026-56208"
],
"database_specific": {
"cwe_ids": [
"CWE-122"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-19T17:16:30Z",
"severity": "HIGH"
},
"details": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"id": "GHSA-mgv2-4j37-m3x6",
"modified": "2026-07-29T00:31:35Z",
"published": "2026-06-19T18:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"type": "WEB",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/504317456"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-56208.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
RHSA-2026:30814
Vulnerability from csaf_redhat - Published: 2026-06-28 22:34 - Updated: 2026-07-28 23:10Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
aom:
* aom-3.14.0-0.1.hum1 (aarch64, x86_64)
* libaom-3.14.0-0.1.hum1 (aarch64, x86_64)
* libaom-devel-3.14.0-0.1.hum1 (aarch64, x86_64)
* libaom-devel-docs-3.14.0-0.1.hum1 (aarch64, x86_64)
* aom-3.14.0-0.1.hum1.src (src)
Security Fix(es):
aom:
* CVE-2026-56208
* CVE-2026-56209
* CVE-2026-56210
* CVE-2026-56211
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
7.6 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:aom-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:aom-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:aom-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:aom-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:aom-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
30 references
Acknowledgments
FuzzAnything
The FuzzAnything Team
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\naom:\n * aom-3.14.0-0.1.hum1 (aarch64, x86_64)\n * libaom-3.14.0-0.1.hum1 (aarch64, x86_64)\n * libaom-devel-3.14.0-0.1.hum1 (aarch64, x86_64)\n * libaom-devel-docs-3.14.0-0.1.hum1 (aarch64, x86_64)\n * aom-3.14.0-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\naom:\n * CVE-2026-56208\n * CVE-2026-56209\n * CVE-2026-56210\n * CVE-2026-56211",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:30814",
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56208",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56209",
"url": "https://access.redhat.com/security/cve/CVE-2026-56209"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56210",
"url": "https://access.redhat.com/security/cve/CVE-2026-56210"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-56211",
"url": "https://access.redhat.com/security/cve/CVE-2026-56211"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30814.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-07-28T23:10:12+00:00",
"generator": {
"date": "2026-07-28T23:10:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:30814",
"initial_release_date": "2026-06-28T22:34:27+00:00",
"revision_history": [
{
"date": "2026-06-28T22:34:27+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-25T05:39:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-28T23:10:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-main@aarch64",
"product": {
"name": "aom-main@aarch64",
"product_id": "aom-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-main@src",
"product": {
"name": "aom-main@src",
"product_id": "aom-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-main@x86_64",
"product": {
"name": "aom-main@x86_64",
"product_id": "aom-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:aom-main@aarch64"
},
"product_reference": "aom-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:aom-main@src"
},
"product_reference": "aom-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:aom-main@x86_64"
},
"product_reference": "aom-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56208",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490799"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because a heap buffer overflow with attacker-influenced data can cause reliable denial of service and potentially lead to code execution, though the attacker has only indirect control over the written values (encoder-computed statistics). In Red Hat products, libaom ships bundled within Firefox and Thunderbird as a statically-linked dependency used for AV1 decoding and WebRTC encoding. The vulnerable code path requires the encoder to be configured with g_lag_in_frames \u003e= 1 (Look-Ahead Processing mode). In Firefox\u0027s WebRTC implementation, the encoder configuration is controlled by the browser itself and not exposed to remote peers, which significantly limits the attack surface compared to standalone transcoding services. RHEL-AI 3.4 and Hummingbird 1 ship standalone libaom (aom) packages at versions within the affected range. Applications on those platforms that use the libaom encoder API with LAP mode and accept untrusted configuration input are vulnerable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"category": "external",
"summary": "RHBZ#2490799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56208"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/243f8ae84b",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/504317456",
"url": "https://issues.chromium.org/issues/504317456"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-28T22:34:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding.",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56209",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490800"
}
],
"notes": [
{
"category": "description",
"text": "An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity because it provides a fully deterministic arbitrary address write primitive that requires no information leak and is self-bootstrapping from attacker-controlled pixel values. The 1,200-byte write at an attacker-chosen address is sufficient for control flow hijacking. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. The vulnerable code path requires the SVC (Scalable Video Coding) encoder feature to be enabled and the attacker to control both the layer_id configuration and the image frame pixel values. In Firefox\u0027s WebRTC implementation, SVC encoding parameters and frame submission are managed internally by the browser; a remote peer cannot directly set arbitrary layer IDs or inject pixel values into the local encoder. This significantly reduces exploitability in the browser context. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Services on those platforms that expose the SVC encoder API with attacker-controlled layer configuration and frame input are at highest risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56209"
},
{
"category": "external",
"summary": "RHBZ#2490800",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490800"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56209"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56209",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56209"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503993984",
"url": "https://issues.chromium.org/issues/503993984"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-28T22:34:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library with SVC enabled, validate that spatial_layer_id and temporal_layer_id values are within the configured range [0, configured_layers) before calling aom_codec_control with AV1E_SET_SVC_LAYER_ID.\n2. Restrict access to encoding services to trusted clients only. Do not expose libaom SVC encoder configuration to untrusted input.\n3. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n4. Deploy encoding services with ASLR, stack canaries, and other exploit mitigation technologies enabled.",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56210",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490801"
}
],
"notes": [
{
"category": "description",
"text": "A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because the 40KB out-of-bounds heap read can disclose sensitive information from adjacent heap allocations (including pointers useful for ASLR bypass in chained attacks) and reliably causes denial of service by hitting unmapped pages. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. The vulnerable code path requires the SVC encoder feature to be enabled and an attacker to set spatial_layer_id to a value exceeding the number of configured spatial layers. In Firefox\u0027s WebRTC implementation, SVC layer parameters are managed internally by the browser and not directly exposed to remote peers, which limits exploitability. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Services that expose SVC encoder layer configuration to untrusted input are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56210"
},
{
"category": "external",
"summary": "RHBZ#2490801",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490801"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56210"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56210",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56210"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503975732",
"url": "https://issues.chromium.org/issues/503975732"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-28T22:34:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library with SVC enabled, validate that spatial_layer_id does not exceed the number of configured spatial layers before calling aom_codec_control with AV1E_SET_SVC_LAYER_ID.\n2. Restrict access to encoding services to trusted clients only.\n3. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n4. Monitor encoding service processes for unexpected crashes (segfaults) that may indicate exploitation attempts.",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56211",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490802"
}
],
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0027s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity because the researcher demonstrated successful remote code execution against a fork-based video processing service. The exploit chain leverages attacker-controlled pixel values to hijack internal encoder pointers, uses a crash oracle to brute-force ASLR, and ultimately achieves arbitrary command execution. However, the attack complexity is elevated: it requires a fork-based service architecture (for the crash oracle), multiple encoding attempts (for ASLR brute-force), and knowledge of the target binary layout. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. Firefox does not use a fork-based architecture for WebRTC encoding, and SVC layer parameters are managed internally, making the demonstrated exploit chain not directly applicable to the browser context. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Fork-based transcoding or video conferencing services that use libaom with SVC encoding and accept attacker-supplied frames are at highest risk for this specific exploit chain.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56211"
},
{
"category": "external",
"summary": "RHBZ#2490802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56211"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56211",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56211"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503993985",
"url": "https://issues.chromium.org/issues/503993985"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-28T22:34:27+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:30814"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder in a fork-based service, validate all SVC layer parameters (spatial_layer_id, temporal_layer_id) against configured bounds before passing them to the encoder API.\n2. Avoid fork-based architectures for encoding services that accept untrusted input. Use thread-based or container-isolated workers instead, which prevent crash oracle attacks.\n3. Restrict access to encoding services to trusted clients only. Do not expose SVC encoder configuration or frame submission to untrusted network input.\n4. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n5. Enable all available exploit mitigations (ASLR, PIE, stack canaries, CFI) on encoding service binaries.",
"product_ids": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:aom-main@aarch64",
"Red Hat Hardened Images:aom-main@src",
"Red Hat Hardened Images:aom-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames"
}
]
}
RHSA-2026:42875
Vulnerability from csaf_redhat - Published: 2026-07-21 15:45 - Updated: 2026-07-28 23:10Summary
Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom
Severity
Important
Notes
Topic: AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVE(s) are listed with a severity level of "Important" or higher.
Details: RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
7.6 (High)
Affected products
Fixed
29 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.
7.1 (High)
Affected products
Fixed
29 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).
7.1 (High)
Affected products
Fixed
29 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.
7.1 (High)
Affected products
Fixed
29 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
26 references
Acknowledgments
FuzzAnything
The FuzzAnything Team
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVE(s) are listed with a severity level of \"Important\" or higher.",
"title": "Topic"
},
{
"category": "general",
"text": "RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42875",
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "AIPCC-22882",
"url": "https://issues.redhat.com/browse/AIPCC-22882"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42875.json"
}
],
"title": "Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - aom",
"tracking": {
"current_release_date": "2026-07-28T23:10:13+00:00",
"generator": {
"date": "2026-07-28T23:10:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:42875",
"initial_release_date": "2026-07-21T15:45:15+00:00",
"revision_history": [
{
"date": "2026-07-21T15:45:15+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-21T15:45:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-28T23:10:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product": {
"name": "Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux_ai:3.5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux AI"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-0:3.14.0-1.el9ai.src",
"product": {
"name": "aom-0:3.14.0-1.el9ai.src",
"product_id": "aom-0:3.14.0-1.el9ai.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-1.el9ai?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "aom-0:3.14.0-1.el9ai.x86_64",
"product_id": "aom-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libaom-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "libaom-0:3.14.0-1.el9ai.x86_64",
"product_id": "libaom-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "libaom-devel-0:3.14.0-1.el9ai.x86_64",
"product_id": "libaom-devel-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.x86_64",
"product_id": "libaom-devel-docs-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel-docs@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"product_id": "aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debugsource@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product_id": "aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debuginfo@3.14.0-1.el9ai?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product_id": "libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-debuginfo@3.14.0-1.el9ai?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "aom-0:3.14.0-1.el9ai.aarch64",
"product_id": "aom-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libaom-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "libaom-0:3.14.0-1.el9ai.aarch64",
"product_id": "libaom-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "libaom-devel-0:3.14.0-1.el9ai.aarch64",
"product_id": "libaom-devel-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"product_id": "libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel-docs@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"product_id": "aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debugsource@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product_id": "aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debuginfo@3.14.0-1.el9ai?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product_id": "libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-debuginfo@3.14.0-1.el9ai?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "aom-0:3.14.0-1.el9ai.s390x",
"product_id": "aom-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libaom-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "libaom-0:3.14.0-1.el9ai.s390x",
"product_id": "libaom-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "libaom-devel-0:3.14.0-1.el9ai.s390x",
"product_id": "libaom-devel-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"product_id": "libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel-docs@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "aom-debugsource-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.s390x",
"product_id": "aom-debugsource-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debugsource@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product_id": "aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debuginfo@3.14.0-1.el9ai?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product_id": "libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-debuginfo@3.14.0-1.el9ai?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "aom-0:3.14.0-1.el9ai.ppc64le",
"product_id": "aom-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libaom-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "libaom-0:3.14.0-1.el9ai.ppc64le",
"product_id": "libaom-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"product_id": "libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"product_id": "libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-devel-docs@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"product_id": "aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debugsource@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product_id": "aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/aom-debuginfo@3.14.0-1.el9ai?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product_id": "libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libaom-debuginfo@3.14.0-1.el9ai?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "aom-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "aom-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "aom-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-0:3.14.0-1.el9ai.src as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src"
},
"product_reference": "aom-0:3.14.0-1.el9ai.src",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "aom-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debuginfo-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "aom-debugsource-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-debugsource-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "libaom-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "libaom-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "libaom-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "libaom-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-debuginfo-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "libaom-devel-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "libaom-devel-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "libaom-devel-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.aarch64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64"
},
"product_reference": "libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le"
},
"product_reference": "libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.s390x as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x"
},
"product_reference": "libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"relates_to_product_reference": "9Base-RHELAI-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom-devel-docs-0:3.14.0-1.el9ai.x86_64 as a component of Red Hat Enterprise Linux AI 3.5 for RHEL 9",
"product_id": "9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
},
"product_reference": "libaom-devel-docs-0:3.14.0-1.el9ai.x86_64",
"relates_to_product_reference": "9Base-RHELAI-3.5"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56208",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490799"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because a heap buffer overflow with attacker-influenced data can cause reliable denial of service and potentially lead to code execution, though the attacker has only indirect control over the written values (encoder-computed statistics). In Red Hat products, libaom ships bundled within Firefox and Thunderbird as a statically-linked dependency used for AV1 decoding and WebRTC encoding. The vulnerable code path requires the encoder to be configured with g_lag_in_frames \u003e= 1 (Look-Ahead Processing mode). In Firefox\u0027s WebRTC implementation, the encoder configuration is controlled by the browser itself and not exposed to remote peers, which significantly limits the attack surface compared to standalone transcoding services. RHEL-AI 3.4 and Hummingbird 1 ship standalone libaom (aom) packages at versions within the affected range. Applications on those platforms that use the libaom encoder API with LAP mode and accept untrusted configuration input are vulnerable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"category": "external",
"summary": "RHBZ#2490799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56208"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/243f8ae84b",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/504317456",
"url": "https://issues.chromium.org/issues/504317456"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T15:45:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding.",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56209",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490800"
}
],
"notes": [
{
"category": "description",
"text": "An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity because it provides a fully deterministic arbitrary address write primitive that requires no information leak and is self-bootstrapping from attacker-controlled pixel values. The 1,200-byte write at an attacker-chosen address is sufficient for control flow hijacking. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. The vulnerable code path requires the SVC (Scalable Video Coding) encoder feature to be enabled and the attacker to control both the layer_id configuration and the image frame pixel values. In Firefox\u0027s WebRTC implementation, SVC encoding parameters and frame submission are managed internally by the browser; a remote peer cannot directly set arbitrary layer IDs or inject pixel values into the local encoder. This significantly reduces exploitability in the browser context. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Services on those platforms that expose the SVC encoder API with attacker-controlled layer configuration and frame input are at highest risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56209"
},
{
"category": "external",
"summary": "RHBZ#2490800",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490800"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56209",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56209"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56209",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56209"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503993984",
"url": "https://issues.chromium.org/issues/503993984"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T15:45:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library with SVC enabled, validate that spatial_layer_id and temporal_layer_id values are within the configured range [0, configured_layers) before calling aom_codec_control with AV1E_SET_SVC_LAYER_ID.\n2. Restrict access to encoding services to trusted clients only. Do not expose libaom SVC encoder configuration to untrusted input.\n3. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n4. Deploy encoding services with ASLR, stack canaries, and other exploit mitigation technologies enabled.",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56210",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490801"
}
],
"notes": [
{
"category": "description",
"text": "A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because the 40KB out-of-bounds heap read can disclose sensitive information from adjacent heap allocations (including pointers useful for ASLR bypass in chained attacks) and reliably causes denial of service by hitting unmapped pages. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. The vulnerable code path requires the SVC encoder feature to be enabled and an attacker to set spatial_layer_id to a value exceeding the number of configured spatial layers. In Firefox\u0027s WebRTC implementation, SVC layer parameters are managed internally by the browser and not directly exposed to remote peers, which limits exploitability. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Services that expose SVC encoder layer configuration to untrusted input are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56210"
},
{
"category": "external",
"summary": "RHBZ#2490801",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490801"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56210",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56210"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56210",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56210"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503975732",
"url": "https://issues.chromium.org/issues/503975732"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T15:45:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library with SVC enabled, validate that spatial_layer_id does not exceed the number of configured spatial layers before calling aom_codec_control with AV1E_SET_SVC_LAYER_ID.\n2. Restrict access to encoding services to trusted clients only.\n3. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n4. Monitor encoding service processes for unexpected crashes (segfaults) that may indicate exploitation attempts.",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56211",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490802"
}
],
"notes": [
{
"category": "description",
"text": "A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0027s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity because the researcher demonstrated successful remote code execution against a fork-based video processing service. The exploit chain leverages attacker-controlled pixel values to hijack internal encoder pointers, uses a crash oracle to brute-force ASLR, and ultimately achieves arbitrary command execution. However, the attack complexity is elevated: it requires a fork-based service architecture (for the crash oracle), multiple encoding attempts (for ASLR brute-force), and knowledge of the target binary layout. In Red Hat products, libaom ships bundled within Firefox and Thunderbird. Firefox does not use a fork-based architecture for WebRTC encoding, and SVC layer parameters are managed internally, making the demonstrated exploit chain not directly applicable to the browser context. RHEL-AI 3.4 (aom 3.12.0) and Hummingbird 1 (aom 3.13.3) ship standalone libaom packages within the affected version range. Fork-based transcoding or video conferencing services that use libaom with SVC encoding and accept attacker-supplied frames are at highest risk for this specific exploit chain.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56211"
},
{
"category": "external",
"summary": "RHBZ#2490802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56211",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56211"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56211",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56211"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa",
"url": "https://aomedia.googlesource.com/aom/+/a93ba0ffaa"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/503993985",
"url": "https://issues.chromium.org/issues/503993985"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T15:45:15+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42875"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder in a fork-based service, validate all SVC layer parameters (spatial_layer_id, temporal_layer_id) against configured bounds before passing them to the encoder API.\n2. Avoid fork-based architectures for encoding services that accept untrusted input. Use thread-based or container-isolated workers instead, which prevent crash oracle attacks.\n3. Restrict access to encoding services to trusted clients only. Do not expose SVC encoder configuration or frame submission to untrusted network input.\n4. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n5. Enable all available exploit mitigations (ASLR, PIE, stack canaries, CFI) on encoding service binaries.",
"product_ids": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.src",
"9Base-RHELAI-3.5:aom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:aom-debugsource-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-debuginfo-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-0:3.14.0-1.el9ai.x86_64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.aarch64",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.ppc64le",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.s390x",
"9Base-RHELAI-3.5:libaom-devel-docs-0:3.14.0-1.el9ai.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames"
}
]
}
RHSA-2026:47105
Vulnerability from csaf_redhat - Published: 2026-07-28 21:25 - Updated: 2026-07-29 04:24Summary
Red Hat Security Advisory: firefox security update
Severity
Important
Notes
Topic: An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)
* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.
8.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DOM: Navigation component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: cubeb component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Navigation component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Invalid pointer in the DOM: Bindings (WebIDL) component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Graphics: ImageLib component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Graphics component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Graphics: WebRender component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Audio/Video: GMP component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the WebRTC: Audio/Video component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript: WebAssembly component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the JavaScript: WebAssembly component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Integer overflow in the JavaScript: WebAssembly component
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking: HTTP component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the PDF Viewer component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Content Processes component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: DNS component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Networking component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Site isolation issue in the Networking component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Enterprise Policies component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Storage: IndexedDB component
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in WebExtensions
6.1 (Medium)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Networking: WebSockets component
CWE-201 - Insertion of Sensitive Information Into Sent DataAffected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
7.6 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
234 references
Acknowledgments
FuzzAnything
The FuzzAnything Team
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:47105",
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2490799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"category": "external",
"summary": "2499973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499973"
},
{
"category": "external",
"summary": "2499974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499974"
},
{
"category": "external",
"summary": "2503415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503415"
},
{
"category": "external",
"summary": "2503416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503416"
},
{
"category": "external",
"summary": "2503420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503420"
},
{
"category": "external",
"summary": "2503423",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503423"
},
{
"category": "external",
"summary": "2503425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503425"
},
{
"category": "external",
"summary": "2503430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503430"
},
{
"category": "external",
"summary": "2503432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503432"
},
{
"category": "external",
"summary": "2503434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503434"
},
{
"category": "external",
"summary": "2503439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503439"
},
{
"category": "external",
"summary": "2503440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503440"
},
{
"category": "external",
"summary": "2503444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503444"
},
{
"category": "external",
"summary": "2503451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503451"
},
{
"category": "external",
"summary": "2503454",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503454"
},
{
"category": "external",
"summary": "2503456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503456"
},
{
"category": "external",
"summary": "2503463",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503463"
},
{
"category": "external",
"summary": "2503472",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503472"
},
{
"category": "external",
"summary": "2503473",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503473"
},
{
"category": "external",
"summary": "2503485",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503485"
},
{
"category": "external",
"summary": "2503489",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503489"
},
{
"category": "external",
"summary": "2503491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503491"
},
{
"category": "external",
"summary": "2503497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503497"
},
{
"category": "external",
"summary": "2503498",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503498"
},
{
"category": "external",
"summary": "2503500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503500"
},
{
"category": "external",
"summary": "2503501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503501"
},
{
"category": "external",
"summary": "2503505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503505"
},
{
"category": "external",
"summary": "2503512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503512"
},
{
"category": "external",
"summary": "2503513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503513"
},
{
"category": "external",
"summary": "2503517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503517"
},
{
"category": "external",
"summary": "2503521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503521"
},
{
"category": "external",
"summary": "2503527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503527"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47105.json"
}
],
"title": "Red Hat Security Advisory: firefox security update",
"tracking": {
"current_release_date": "2026-07-29T04:24:58+00:00",
"generator": {
"date": "2026-07-29T04:24:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:47105",
"initial_release_date": "2026-07-28T21:25:59+00:00",
"revision_history": [
{
"date": "2026-07-28T21:25:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-28T21:25:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-29T04:24:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.13.0-1.el8_10.src",
"product": {
"name": "firefox-0:140.13.0-1.el8_10.src",
"product_id": "firefox-0:140.13.0-1.el8_10.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.13.0-1.el8_10.aarch64",
"product": {
"name": "firefox-0:140.13.0-1.el8_10.aarch64",
"product_id": "firefox-0:140.13.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"product": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"product_id": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"product": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.13.0-1.el8_10.ppc64le",
"product": {
"name": "firefox-0:140.13.0-1.el8_10.ppc64le",
"product_id": "firefox-0:140.13.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"product": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"product_id": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"product": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.13.0-1.el8_10.x86_64",
"product": {
"name": "firefox-0:140.13.0-1.el8_10.x86_64",
"product_id": "firefox-0:140.13.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
"product": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
"product_id": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"product": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "firefox-0:140.13.0-1.el8_10.s390x",
"product": {
"name": "firefox-0:140.13.0-1.el8_10.s390x",
"product_id": "firefox-0:140.13.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"product": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"product_id": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"product": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64"
},
"product_reference": "firefox-0:140.13.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le"
},
"product_reference": "firefox-0:140.13.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x"
},
"product_reference": "firefox-0:140.13.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.13.0-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src"
},
"product_reference": "firefox-0:140.13.0-1.el8_10.src",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64"
},
"product_reference": "firefox-0:140.13.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64"
},
"product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le"
},
"product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x"
},
"product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64"
},
"product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64"
},
"product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le"
},
"product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x"
},
"product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
"product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
},
"product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
"relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-15718",
"discovery_date": "2026-07-14T13:02:41.162425+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499974"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15718"
},
{
"category": "external",
"summary": "RHBZ#2499974",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499974"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15718"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15718",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15718"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718"
}
],
"release_date": "2026-07-14T12:15:46.176000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component"
},
{
"cve": "CVE-2026-15719",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-07-14T13:02:22.676677+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499973"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Site isolation issue in the DOM: Navigation component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15719"
},
{
"category": "external",
"summary": "RHBZ#2499973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499973"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15719",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15719"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15719",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15719"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15719",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15719"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15719",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15719"
}
],
"release_date": "2026-07-14T12:15:47.592000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Site isolation issue in the DOM: Navigation component"
},
{
"cve": "CVE-2026-16349",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-07-21T13:03:40.142033+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503485"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the DOM: Navigation component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16349"
},
{
"category": "external",
"summary": "RHBZ#2503485",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503485"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16349",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16349"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16349",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16349"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16349",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16349"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16349",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16349"
}
],
"release_date": "2026-07-21T12:37:31.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component"
},
{
"cve": "CVE-2026-16350",
"discovery_date": "2026-07-21T13:01:11.415957+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: cubeb component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16350"
},
{
"category": "external",
"summary": "RHBZ#2503416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16350",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16350"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16350",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16350"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16350",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16350"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16350",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16350"
}
],
"release_date": "2026-07-21T12:37:32.759000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component"
},
{
"cve": "CVE-2026-16351",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-21T13:03:55.355115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503491"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Navigation component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16351"
},
{
"category": "external",
"summary": "RHBZ#2503491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503491"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16351"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16351",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16351"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16351",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16351"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16351",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16351"
}
],
"release_date": "2026-07-21T12:37:34.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component"
},
{
"cve": "CVE-2026-16352",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-21T13:02:10.079600+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503444"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Disability Access APIs component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16352"
},
{
"category": "external",
"summary": "RHBZ#2503444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503444"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16352"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16352",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16352"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16352",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16352"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16352",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16352"
}
],
"release_date": "2026-07-21T12:37:35.292000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component"
},
{
"cve": "CVE-2026-16353",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-07-21T13:04:57.762278+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503517"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInvalid pointer in the DOM: Bindings (WebIDL) component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16353"
},
{
"category": "external",
"summary": "RHBZ#2503517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503517"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16353",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16353"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16353",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16353"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16353",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16353"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16353",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16353"
}
],
"release_date": "2026-07-21T12:37:39.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component"
},
{
"cve": "CVE-2026-16354",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-21T13:04:15.680875+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503500"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Graphics: ImageLib component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16354"
},
{
"category": "external",
"summary": "RHBZ#2503500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503500"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16354",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16354"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16354",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16354"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16354",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16354"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16354",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16354"
}
],
"release_date": "2026-07-21T12:37:40.337000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component"
},
{
"cve": "CVE-2026-16355",
"discovery_date": "2026-07-21T13:02:01.136257+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503439"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript Engine: JIT component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16355"
},
{
"category": "external",
"summary": "RHBZ#2503439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16355",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16355"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16355",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16355"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355"
}
],
"release_date": "2026-07-21T12:37:43.741000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component"
},
{
"cve": "CVE-2026-16356",
"discovery_date": "2026-07-21T13:01:29.696265+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Disability Access APIs component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16356"
},
{
"category": "external",
"summary": "RHBZ#2503425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16356"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16356",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16356"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16356",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16356"
}
],
"release_date": "2026-07-21T12:37:44.585000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component"
},
{
"cve": "CVE-2026-16357",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-21T13:03:51.750809+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503489"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Graphics component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions in the Graphics component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16357"
},
{
"category": "external",
"summary": "RHBZ#2503489",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503489"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16357"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16357",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16357"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16357",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16357"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16357",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16357"
}
],
"release_date": "2026-07-21T12:37:45.425000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions in the Graphics component"
},
{
"cve": "CVE-2026-16358",
"cwe": {
"id": "CWE-368",
"name": "Context Switching Race Condition"
},
"discovery_date": "2026-07-21T13:03:11.591974+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503472"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Graphics: WebRender component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Site isolation issue in the Graphics: WebRender component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16358"
},
{
"category": "external",
"summary": "RHBZ#2503472",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503472"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16358",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16358"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16358",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16358"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16358",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16358"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16358",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16358"
}
],
"release_date": "2026-07-21T12:37:54.669000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Site isolation issue in the Graphics: WebRender component"
},
{
"cve": "CVE-2026-16359",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-21T13:04:29.562158+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: GMP component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16359"
},
{
"category": "external",
"summary": "RHBZ#2503505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16359"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16359",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16359"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16359",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16359"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16359",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16359"
}
],
"release_date": "2026-07-21T12:38:07.338000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component"
},
{
"cve": "CVE-2026-16360",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-07-21T13:02:39.804147+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503456"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16360"
},
{
"category": "external",
"summary": "RHBZ#2503456",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503456"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16360"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16360",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16360"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360"
}
],
"release_date": "2026-07-21T12:38:24.293000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153"
},
{
"cve": "CVE-2026-16361",
"discovery_date": "2026-07-21T13:02:04.174100+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503440"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16361"
},
{
"category": "external",
"summary": "RHBZ#2503440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503440"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16361",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16361"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16361",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16361"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16361",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16361"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16361",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16361"
}
],
"release_date": "2026-07-21T12:38:27.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13"
},
{
"cve": "CVE-2026-16362",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-21T13:02:52.951321+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503463"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the WebRTC: Audio/Video component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16362"
},
{
"category": "external",
"summary": "RHBZ#2503463",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503463"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16362",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16362"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16362",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16362"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16362",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16362"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16362",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16362"
}
],
"release_date": "2026-07-21T12:37:33.621000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component"
},
{
"cve": "CVE-2026-16363",
"cwe": {
"id": "CWE-733",
"name": "Compiler Optimization Removal or Modification of Security-critical Code"
},
"discovery_date": "2026-07-21T13:01:42.548758+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503430"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript: WebAssembly component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16363"
},
{
"category": "external",
"summary": "RHBZ#2503430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503430"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16363",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16363"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16363",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16363"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16363",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16363"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16363",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16363"
}
],
"release_date": "2026-07-21T12:37:36.171000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component"
},
{
"cve": "CVE-2026-16368",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-21T13:02:26.198789+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503451"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the JavaScript: WebAssembly component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16368"
},
{
"category": "external",
"summary": "RHBZ#2503451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16368"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16368",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16368"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16368",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16368"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16368",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16368"
}
],
"release_date": "2026-07-21T12:37:41.992000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component"
},
{
"cve": "CVE-2026-16369",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-07-21T13:04:46.922091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503513"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the JavaScript: WebAssembly component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16369"
},
{
"category": "external",
"summary": "RHBZ#2503513",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503513"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16369"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16369",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16369"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16369",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16369"
}
],
"release_date": "2026-07-21T12:37:42.865000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component"
},
{
"cve": "CVE-2026-16371",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-07-21T13:04:09.237706+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503497"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Navigation component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16371"
},
{
"category": "external",
"summary": "RHBZ#2503497",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503497"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16371",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16371"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16371",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16371"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16371",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16371"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16371",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16371"
}
],
"release_date": "2026-07-21T12:37:47.142000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component"
},
{
"cve": "CVE-2026-16374",
"cwe": {
"id": "CWE-215",
"name": "Insertion of Sensitive Information Into Debugging Code"
},
"discovery_date": "2026-07-21T13:04:20.487182+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503501"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Framework component in DevTools",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Information disclosure in the Framework component in DevTools",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16374"
},
{
"category": "external",
"summary": "RHBZ#2503501",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503501"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16374",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16374"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16374",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16374"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16374",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16374"
}
],
"release_date": "2026-07-21T12:37:49.664000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Information disclosure in the Framework component in DevTools"
},
{
"cve": "CVE-2026-16375",
"discovery_date": "2026-07-21T13:01:26.390810+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503423"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Networking: HTTP component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Site isolation issue in the Networking: HTTP component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16375"
},
{
"category": "external",
"summary": "RHBZ#2503423",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503423"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16375",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16375"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16375",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16375"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16375",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16375"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16375",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16375"
}
],
"release_date": "2026-07-21T12:37:50.458000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Site isolation issue in the Networking: HTTP component"
},
{
"cve": "CVE-2026-16377",
"discovery_date": "2026-07-21T13:02:33.453713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503454"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the PDF Viewer component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Mitigation bypass in the PDF Viewer component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16377"
},
{
"category": "external",
"summary": "RHBZ#2503454",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503454"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16377",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16377"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16377",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16377"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16377",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16377"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16377",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16377"
}
],
"release_date": "2026-07-21T12:37:52.135000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Mitigation bypass in the PDF Viewer component"
},
{
"cve": "CVE-2026-16379",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-07-21T13:04:12.021375+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503498"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Content Processes component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Privilege escalation in the DOM: Content Processes component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16379"
},
{
"category": "external",
"summary": "RHBZ#2503498",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503498"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16379"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16379",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16379"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16379",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16379"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16379",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16379"
}
],
"release_date": "2026-07-21T12:37:53.832000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Privilege escalation in the DOM: Content Processes component"
},
{
"cve": "CVE-2026-16381",
"cwe": {
"id": "CWE-346",
"name": "Origin Validation Error"
},
"discovery_date": "2026-07-21T13:01:51.230556+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503434"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Networking: DNS component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16381"
},
{
"category": "external",
"summary": "RHBZ#2503434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503434"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16381"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16381",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16381"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16381",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16381"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16381",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16381"
}
],
"release_date": "2026-07-21T12:37:56.371000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component"
},
{
"cve": "CVE-2026-16383",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-07-21T13:04:43.253585+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503512"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Networking component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Mitigation bypass in the DOM: Networking component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16383"
},
{
"category": "external",
"summary": "RHBZ#2503512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503512"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16383"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16383",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16383"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16383",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16383"
}
],
"release_date": "2026-07-21T12:37:58.017000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Mitigation bypass in the DOM: Networking component"
},
{
"cve": "CVE-2026-16387",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-07-21T13:03:15.259855+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503473"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Networking component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Site isolation issue in the Networking component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16387"
},
{
"category": "external",
"summary": "RHBZ#2503473",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503473"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16387"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16387",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16387"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16387",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16387"
}
],
"release_date": "2026-07-21T12:38:01.478000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Site isolation issue in the Networking component"
},
{
"cve": "CVE-2026-16390",
"discovery_date": "2026-07-21T13:01:08.261586+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503415"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Enterprise Policies component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Mitigation bypass in the Enterprise Policies component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16390"
},
{
"category": "external",
"summary": "RHBZ#2503415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503415"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16390"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16390",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16390"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16390",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16390"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16390",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16390"
}
],
"release_date": "2026-07-21T12:38:04.009000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Mitigation bypass in the Enterprise Policies component"
},
{
"cve": "CVE-2026-16391",
"discovery_date": "2026-07-21T13:01:20.641285+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503420"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Storage: IndexedDB component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Information disclosure in the Storage: IndexedDB component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16391"
},
{
"category": "external",
"summary": "RHBZ#2503420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503420"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16391"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16391",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16391"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16391",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16391"
}
],
"release_date": "2026-07-21T12:38:04.805000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Information disclosure in the Storage: IndexedDB component"
},
{
"cve": "CVE-2026-16396",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-07-21T13:05:05.443790+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503521"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in WebExtensions",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Privilege escalation in WebExtensions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16396"
},
{
"category": "external",
"summary": "RHBZ#2503521",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503521"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16396"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16396",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16396"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16396",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16396"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16396",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16396"
}
],
"release_date": "2026-07-21T12:38:09.831000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "firefox: thunderbird: Privilege escalation in WebExtensions"
},
{
"cve": "CVE-2026-16405",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-21T13:05:21.848352+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503527"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Networking: WebSockets component",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Information disclosure in the Networking: WebSockets component",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16405"
},
{
"category": "external",
"summary": "RHBZ#2503527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503527"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16405",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16405"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16405",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16405"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16405",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16405"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16405",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16405"
}
],
"release_date": "2026-07-21T12:38:17.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "firefox: thunderbird: Information disclosure in the Networking: WebSockets component"
},
{
"cve": "CVE-2026-16412",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-07-21T13:01:45.846131+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16412"
},
{
"category": "external",
"summary": "RHBZ#2503432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16412",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16412"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16412",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16412"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16412",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16412"
}
],
"release_date": "2026-07-21T12:38:23.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153"
},
{
"acknowledgments": [
{
"names": [
"The FuzzAnything Team"
],
"organization": "FuzzAnything"
}
],
"cve": "CVE-2026-56208",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-19T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490799"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because a heap buffer overflow with attacker-influenced data can cause reliable denial of service and potentially lead to code execution, though the attacker has only indirect control over the written values (encoder-computed statistics). In Red Hat products, libaom ships bundled within Firefox and Thunderbird as a statically-linked dependency used for AV1 decoding and WebRTC encoding. The vulnerable code path requires the encoder to be configured with g_lag_in_frames \u003e= 1 (Look-Ahead Processing mode). In Firefox\u0027s WebRTC implementation, the encoder configuration is controlled by the browser itself and not exposed to remote peers, which significantly limits the attack surface compared to standalone transcoding services. RHEL-AI 3.4 and Hummingbird 1 ship standalone libaom (aom) packages at versions within the affected range. Applications on those platforms that use the libaom encoder API with LAP mode and accept untrusted configuration input are vulnerable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-56208"
},
{
"category": "external",
"summary": "RHBZ#2490799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-56208",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56208"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208"
},
{
"category": "external",
"summary": "https://aomedia.googlesource.com/aom/+/243f8ae84b",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
},
{
"category": "external",
"summary": "https://issues.chromium.org/issues/504317456",
"url": "https://issues.chromium.org/issues/504317456"
}
],
"release_date": "2026-06-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-28T21:25:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:47105"
},
{
"category": "workaround",
"details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding.",
"product_ids": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
"AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode"
}
]
}
rlsa-2026:47105
Vulnerability from osv_rocky
Published
2026-07-29 18:01
Modified
2026-08-01 12:08
Summary
Important: firefox security update
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
-
libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)
-
firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)
-
firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)
-
firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)
-
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)
-
firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)
-
firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)
-
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)
-
firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)
-
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)
-
firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)
-
firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)
-
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)
-
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)
-
firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)
-
firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)
-
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)
-
firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)
-
firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)
-
firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)
-
firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)
-
firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)
-
firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)
-
firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)
-
firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)
-
firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)
-
firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)
-
firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)
-
firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)
-
firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)
-
firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)
-
firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)
-
firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
8.8 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:8",
"name": "firefox",
"purl": "pkg:rpm/rocky-linux/firefox?distro=rocky-linux-8\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:140.13.0-1.el8_10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:47105",
"modified": "2026-08-01T12:08:21.186290Z",
"published": "2026-07-29T18:01:13.110756Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:47105"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499973"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499974"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503415"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503416"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503420"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503423"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503425"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503430"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503432"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503434"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503439"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503440"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503444"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503451"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503454"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503456"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503463"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503472"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503473"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503485"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503489"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503491"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503497"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503498"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503500"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503501"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503505"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503512"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503513"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503517"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503521"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503527"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: firefox security update",
"upstream": [
"CVE-2026-15718",
"CVE-2026-15719",
"CVE-2026-16349",
"CVE-2026-16350",
"CVE-2026-16351",
"CVE-2026-16352",
"CVE-2026-16353",
"CVE-2026-16354",
"CVE-2026-16355",
"CVE-2026-16356",
"CVE-2026-16357",
"CVE-2026-16358",
"CVE-2026-16359",
"CVE-2026-16360",
"CVE-2026-16361",
"CVE-2026-16362",
"CVE-2026-16363",
"CVE-2026-16368",
"CVE-2026-16369",
"CVE-2026-16371",
"CVE-2026-16374",
"CVE-2026-16375",
"CVE-2026-16377",
"CVE-2026-16379",
"CVE-2026-16381",
"CVE-2026-16383",
"CVE-2026-16387",
"CVE-2026-16390",
"CVE-2026-16391",
"CVE-2026-16396",
"CVE-2026-16405",
"CVE-2026-16412",
"CVE-2026-56208"
]
}
SUSE-SU-2026:22369-1
Vulnerability from csaf_suse - Published: 2026-06-25 19:33 - Updated: 2026-06-25 19:33Summary
Security update for libaom
Severity
Important
Notes
Title of the patch: Security update for libaom
Description of the patch: This update for libaom fixes the following issues
- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash
(bsc#1268650).
- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write
(bsc#1268651).
- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).
Patchnames: SUSE-SLES-16.0-1082
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.1 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.1 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
20 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/s… | self |
| https://www.suse.com/support/update/announcement/… | self |
| https://lists.suse.com/pipermail/sle-updates/2026… | self |
| https://bugzilla.suse.com/1268650 | self |
| https://bugzilla.suse.com/1268651 | self |
| https://bugzilla.suse.com/1268653 | self |
| https://bugzilla.suse.com/1268655 | self |
| https://www.suse.com/security/cve/CVE-2026-56208/ | self |
| https://www.suse.com/security/cve/CVE-2026-56209/ | self |
| https://www.suse.com/security/cve/CVE-2026-56210/ | self |
| https://www.suse.com/security/cve/CVE-2026-56211/ | self |
| https://www.suse.com/security/cve/CVE-2026-56208 | external |
| https://bugzilla.suse.com/1268650 | external |
| https://www.suse.com/security/cve/CVE-2026-56209 | external |
| https://bugzilla.suse.com/1268651 | external |
| https://www.suse.com/security/cve/CVE-2026-56210 | external |
| https://bugzilla.suse.com/1268653 | external |
| https://www.suse.com/security/cve/CVE-2026-56211 | external |
| https://bugzilla.suse.com/1268655 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for libaom",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for libaom fixes the following issues\n\n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash\n (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write\n (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-1082",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22369-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22369-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622369-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22369-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-July/047770.html"
},
{
"category": "self",
"summary": "SUSE Bug 1268650",
"url": "https://bugzilla.suse.com/1268650"
},
{
"category": "self",
"summary": "SUSE Bug 1268651",
"url": "https://bugzilla.suse.com/1268651"
},
{
"category": "self",
"summary": "SUSE Bug 1268653",
"url": "https://bugzilla.suse.com/1268653"
},
{
"category": "self",
"summary": "SUSE Bug 1268655",
"url": "https://bugzilla.suse.com/1268655"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56208 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56208/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56209 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56209/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56210 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56210/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56211 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56211/"
}
],
"title": "Security update for libaom",
"tracking": {
"current_release_date": "2026-06-25T19:33:13Z",
"generator": {
"date": "2026-06-25T19:33:13Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22369-1",
"initial_release_date": "2026-06-25T19:33:13Z",
"revision_history": [
{
"date": "2026-06-25T19:33:13Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "aom-tools-3.11.0-160000.3.1.aarch64",
"product": {
"name": "aom-tools-3.11.0-160000.3.1.aarch64",
"product_id": "aom-tools-3.11.0-160000.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libaom3-3.11.0-160000.3.1.aarch64",
"product": {
"name": "libaom3-3.11.0-160000.3.1.aarch64",
"product_id": "libaom3-3.11.0-160000.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-tools-3.11.0-160000.3.1.ppc64le",
"product": {
"name": "aom-tools-3.11.0-160000.3.1.ppc64le",
"product_id": "aom-tools-3.11.0-160000.3.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libaom3-3.11.0-160000.3.1.ppc64le",
"product": {
"name": "libaom3-3.11.0-160000.3.1.ppc64le",
"product_id": "libaom3-3.11.0-160000.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-tools-3.11.0-160000.3.1.s390x",
"product": {
"name": "aom-tools-3.11.0-160000.3.1.s390x",
"product_id": "aom-tools-3.11.0-160000.3.1.s390x"
}
},
{
"category": "product_version",
"name": "libaom3-3.11.0-160000.3.1.s390x",
"product": {
"name": "libaom3-3.11.0-160000.3.1.s390x",
"product_id": "libaom3-3.11.0-160000.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "aom-tools-3.11.0-160000.3.1.x86_64",
"product": {
"name": "aom-tools-3.11.0-160000.3.1.x86_64",
"product_id": "aom-tools-3.11.0-160000.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libaom3-3.11.0-160000.3.1.x86_64",
"product": {
"name": "libaom3-3.11.0-160000.3.1.x86_64",
"product_id": "libaom3-3.11.0-160000.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64"
},
"product_reference": "libaom3-3.11.0-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le"
},
"product_reference": "libaom3-3.11.0-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x"
},
"product_reference": "libaom3-3.11.0-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64"
},
"product_reference": "libaom3-3.11.0-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "aom-tools-3.11.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64"
},
"product_reference": "aom-tools-3.11.0-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64"
},
"product_reference": "libaom3-3.11.0-160000.3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le"
},
"product_reference": "libaom3-3.11.0-160000.3.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x"
},
"product_reference": "libaom3-3.11.0-160000.3.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libaom3-3.11.0-160000.3.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
},
"product_reference": "libaom3-3.11.0-160000.3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56208",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56208"
}
],
"notes": [
{
"category": "general",
"text": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56208",
"url": "https://www.suse.com/security/cve/CVE-2026-56208"
},
{
"category": "external",
"summary": "SUSE Bug 1268650 for CVE-2026-56208",
"url": "https://bugzilla.suse.com/1268650"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T19:33:13Z",
"details": "important"
}
],
"title": "CVE-2026-56208"
},
{
"cve": "CVE-2026-56209",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56209"
}
],
"notes": [
{
"category": "general",
"text": "An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel values. The encoder then writes approximately 1,200 bytes at the attacker-controlled address. This is fully deterministic and does not require a separate information leak. An attacker who can supply frames to a network-facing libaom encoder with SVC enabled could exploit this for denial of service or potential code execution.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56209",
"url": "https://www.suse.com/security/cve/CVE-2026-56209"
},
{
"category": "external",
"summary": "SUSE Bug 1268651 for CVE-2026-56209",
"url": "https://bugzilla.suse.com/1268651"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T19:33:13Z",
"details": "important"
}
],
"title": "CVE-2026-56209"
},
{
"cve": "CVE-2026-56210",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56210"
}
],
"notes": [
{
"category": "general",
"text": "A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56210",
"url": "https://www.suse.com/security/cve/CVE-2026-56210"
},
{
"category": "external",
"summary": "SUSE Bug 1268653 for CVE-2026-56210",
"url": "https://bugzilla.suse.com/1268653"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T19:33:13Z",
"details": "important"
}
],
"title": "CVE-2026-56210"
},
{
"cve": "CVE-2026-56211",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56211"
}
],
"notes": [
{
"category": "general",
"text": "A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder\u0027s SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56211",
"url": "https://www.suse.com/security/cve/CVE-2026-56211"
},
{
"category": "external",
"summary": "SUSE Bug 1268655 for CVE-2026-56211",
"url": "https://bugzilla.suse.com/1268655"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server 16.0:libaom3-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:aom-tools-3.11.0-160000.3.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libaom3-3.11.0-160000.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-25T19:33:13Z",
"details": "important"
}
],
"title": "CVE-2026-56211"
}
]
}
ubuntu-cve-2026-56208
Vulnerability from osv_ubuntu
Published
2026-06-19 17:16
Modified
2026-06-24 09:03
Summary
Details
A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.
Severity
7.6 (High)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "aom-tools",
"binary_version": "1.0.0.errata1-3+deb11u1ubuntu0.1"
},
{
"binary_name": "libaom0",
"binary_version": "1.0.0.errata1-3+deb11u1ubuntu0.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "aom",
"purl": "pkg:deb/ubuntu/aom@1.0.0.errata1-3+deb11u1ubuntu0.1?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0-3",
"1.0.0.errata1-2",
"1.0.0.errata1-2ubuntu3",
"1.0.0.errata1-3",
"1.0.0.errata1-3build1",
"1.0.0.errata1-3+deb11u1build0.20.04.1",
"1.0.0.errata1-3+deb11u1ubuntu0.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "aom-tools",
"binary_version": "3.3.0-1ubuntu0.1"
},
{
"binary_name": "libaom3",
"binary_version": "3.3.0-1ubuntu0.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "aom",
"purl": "pkg:deb/ubuntu/aom@3.3.0-1ubuntu0.1?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0.errata1-3build1",
"3.2.0-2",
"3.3.0-1",
"3.3.0-1ubuntu0.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "aom-tools",
"binary_version": "3.8.2-2ubuntu0.1"
},
{
"binary_name": "libaom3",
"binary_version": "3.8.2-2ubuntu0.1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "aom",
"purl": "pkg:deb/ubuntu/aom@3.8.2-2ubuntu0.1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.1-1",
"3.7.0-1",
"3.7.1-1",
"3.8.1-1",
"3.8.2-2build1",
"3.8.2-2ubuntu0.1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "aom-tools",
"binary_version": "3.12.1-1"
},
{
"binary_name": "libaom3",
"binary_version": "3.12.1-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:25.10",
"name": "aom",
"purl": "pkg:deb/ubuntu/aom@3.12.1-1?arch=source\u0026distro=questing"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.0-1",
"3.12.1-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "aom-tools",
"binary_version": "3.13.1-2"
},
{
"binary_name": "libaom3",
"binary_version": "3.13.1-2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "aom",
"purl": "pkg:deb/ubuntu/aom@3.13.1-2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.13.1-2"
]
}
],
"aliases": [],
"details": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
"id": "UBUNTU-CVE-2026-56208",
"modified": "2026-06-24T09:03:12Z",
"published": "2026-06-19T17:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-56208"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56208"
},
{
"type": "REPORT",
"url": "https://aomedia.googlesource.com/aom/+/243f8ae84bfbc495b3a3c12948abc4dff3af2f84"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
},
{
"type": "REPORT",
"url": "https://issues.chromium.org/issues/504317456"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-56208"
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…