QSN-8772-1: AOM vulnerabilities
2026-09-16

Summary:
Several security issues were fixed in AOM.

Details:
It was discovered that AOM incorrectly handled the first-pass statistics
buffer in Look-Ahead Processing (LAP) mode. An attacker could possibly use
this issue to cause a heap buffer overflow, leading to a denial of service
or possibly execute arbitrary code. (CVE-2026-56208)

It was discovered that AOM incorrectly validated spatial and temporal
layer IDs in the SVC (Scalable Video Coding) encoder controls. An attacker
could possibly use this issue to write to an arbitrary memory address, read
out-of-bounds heap memory, or execute arbitrary code. (CVE-2026-56209,
CVE-2026-56210, CVE-2026-56211)

Affected QuantaStor releases:
  6.9.1.001 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.9.0.464 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.6.015 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.5.018 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.4.038 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.3.018 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.2.002 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.1.007 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)
  6.8.0.205 jammy: libaom3 3.3.0-1ubuntu0.1 (fixed in 3.3.0-1ubuntu0.1+esm1)

CVEs: CVE-2026-56211, CVE-2026-56210, CVE-2026-56209, CVE-2026-56208

References:
  https://ubuntu.com/security/notices/USN-8772-1