{"id":"SUSE-SU-2026:3224-1","summary":"Security update for SVT-AV1, libyuv0, libaom3","details":"This update for SVT-AV1, libyuv0, libaom3 fixes the following issues:\n\n- CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash\n  (bsc#1268650).\n- CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write\n  (bsc#1268651).\n- CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).\n- CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).\n\nBug fixes:\n\n- Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).\n","modified":"2026-07-24T17:16:07.632086048Z","published":"2026-07-23T18:34:24Z","related":["CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211"],"upstream":["CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263224-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1263678"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268242"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268650"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268651"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268653"},{"type":"REPORT","url":"https://bugzilla.suse.com/1268655"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56208"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56209"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56210"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-56211"}],"affected":[{"package":{"name":"SVT-AV1","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/SVT-AV1&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"ecosystem_specific":{"binaries":[{"libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libSvtAv1Enc1":"1.8.0-150600.3.2.5"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/libaom&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"ecosystem_specific":{"binaries":[{"libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libSvtAv1Enc1":"1.8.0-150600.3.2.5"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libyuv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","purl":"pkg:rpm/suse/libyuv&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"ecosystem_specific":{"binaries":[{"libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"SVT-AV1","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","purl":"pkg:rpm/suse/SVT-AV1&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"ecosystem_specific":{"binaries":[{"libyuv-tools":"20230517+a377993-150600.3.4.2","libyuv0":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libaom3":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libyuv-devel":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libaom3-32bit":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","purl":"pkg:rpm/suse/libaom&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"ecosystem_specific":{"binaries":[{"libaom-devel-doc":"3.7.1-150600.3.9.3","libaom-devel":"3.7.1-150600.3.9.1","libaom3":"3.7.1-150600.3.9.1","libyuv-tools":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3-32bit":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","aom-tools":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libyuv-devel":"20230517+a377993-150600.3.4.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom-devel-doc","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","purl":"pkg:rpm/suse/libaom-devel-doc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"ecosystem_specific":{"binaries":[{"libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv-tools":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libaom3-32bit":"3.7.1-150600.3.9.1","aom-tools":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom-devel-doc":"3.7.1-150600.3.9.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libyuv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","purl":"pkg:rpm/suse/libyuv&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Desktop%20Applications%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"ecosystem_specific":{"binaries":[{"libyuv-tools":"20230517+a377993-150600.3.4.2","libyuv-devel":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libaom-devel":"3.7.1-150600.3.9.1","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3-32bit":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom-devel-doc":"3.7.1-150600.3.9.3","libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"SVT-AV1","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/SVT-AV1&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"ecosystem_specific":{"binaries":[{"libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3":"3.7.1-150600.3.9.1","libyuv-tools":"20230517+a377993-150600.3.4.2","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libyuv0":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3","libaom-devel":"3.7.1-150600.3.9.1","libaom3-32bit":"3.7.1-150600.3.9.1","libyuv-devel":"20230517+a377993-150600.3.4.2"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/libaom&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"ecosystem_specific":{"binaries":[{"libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3":"3.7.1-150600.3.9.1","libaom3-32bit":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom-devel":"3.7.1-150600.3.9.1","libyuv-tools":"20230517+a377993-150600.3.4.2","libaom-devel-doc":"3.7.1-150600.3.9.3","aom-tools":"3.7.1-150600.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom-devel-doc","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/libaom-devel-doc&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"ecosystem_specific":{"binaries":[{"libyuv0-32bit":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libaom3":"3.7.1-150600.3.9.1","libaom3-32bit":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3","libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv0":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libyuv-tools":"20230517+a377993-150600.3.4.2","libSvtAv1Enc1":"1.8.0-150600.3.2.5"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libyuv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","purl":"pkg:rpm/suse/libyuv&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"ecosystem_specific":{"binaries":[{"libSvtAv1Enc1":"1.8.0-150600.3.2.5","libyuv-tools":"20230517+a377993-150600.3.4.2","libaom3-32bit":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libaom3":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3","libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","aom-tools":"3.7.1-150600.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"SVT-AV1","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/SVT-AV1&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-150600.3.2.5"}]}],"ecosystem_specific":{"binaries":[{"libaom3-32bit":"3.7.1-150600.3.9.1","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libyuv-devel":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libyuv-tools":"20230517+a377993-150600.3.4.2","libyuv0":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3","libaom3":"3.7.1-150600.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/libaom&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.1"}]}],"ecosystem_specific":{"binaries":[{"libyuv0-32bit":"20230517+a377993-150600.3.4.2","libyuv-tools":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libaom3":"3.7.1-150600.3.9.1","libyuv-devel":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom-devel-doc":"3.7.1-150600.3.9.3","libaom3-32bit":"3.7.1-150600.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libaom-devel-doc","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/libaom-devel-doc&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.1-150600.3.9.3"}]}],"ecosystem_specific":{"binaries":[{"aom-tools":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libyuv-tools":"20230517+a377993-150600.3.4.2","libaom-devel":"3.7.1-150600.3.9.1","libaom3":"3.7.1-150600.3.9.1","libyuv0":"20230517+a377993-150600.3.4.2","libaom-devel-doc":"3.7.1-150600.3.9.3","libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3-32bit":"3.7.1-150600.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}},{"package":{"name":"libyuv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","purl":"pkg:rpm/suse/libyuv&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230517+a377993-150600.3.4.2"}]}],"ecosystem_specific":{"binaries":[{"libyuv-devel":"20230517+a377993-150600.3.4.2","libyuv0":"20230517+a377993-150600.3.4.2","libyuv0-32bit":"20230517+a377993-150600.3.4.2","libaom3-32bit":"3.7.1-150600.3.9.1","libyuv-tools":"20230517+a377993-150600.3.4.2","aom-tools":"3.7.1-150600.3.9.1","libSvtAv1Enc1":"1.8.0-150600.3.2.5","libaom-devel":"3.7.1-150600.3.9.1","libaom3":"3.7.1-150600.3.9.1","libaom-devel-doc":"3.7.1-150600.3.9.3"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:3224-1.json"}}],"schema_version":"1.7.5"}