SUSE-SU-2026:3224-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:3224-1

HIGH8.1

Security update for SVT-AV1, libyuv0, libaom3

Published Jul 23, 2026

Modified 1 months ago

Fix available

Details

Description of the patch:

This update for SVT-AV1, libyuv0, libaom3 fixes the following issues:

CVE-2026-56208: untrusted encoder configuration inputs can lead to a heap-based buffer overflow and a process crash (bsc#1268650).
CVE-2026-56209: crafted video frames with specific Y-plane pixel values can lead to an arbitrary memory write (bsc#1268651).
CVE-2026-56210: missing bounds check on layer_id inputs can lead to an out-of-bounds heap read (bsc#1268653).
CVE-2026-56211: out-of-range spatial/temporal layer selection can lead to remote code execution (bsc#1268655).

Bug fixes:

Add SVT-AV1, libyuv0, libaom3 to Basesystem, no source changes. (bsc#1263678).

Affected Packages

libSvtAv1Enc1

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6

Fixed in:

1.8.0-150600.3.2.5

libaom3

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6

Fixed in:

3.7.1-150600.3.9.1

libyuv0

SUSE Linux Enterprise Desktop 15 SP7SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Basesystem 15 SP7SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6

Fixed in:

20230517+a377993-150600.3.4.2

aom-tools

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.7.1-150600.3.9.1

libaom-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.7.1-150600.3.9.1

libaom-devel-doc

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.7.1-150600.3.9.3

libaom3-32bit

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

3.7.1-150600.3.9.1

libyuv-devel

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

20230517+a377993-150600.3.4.2

libyuv-tools

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

20230517+a377993-150600.3.4.2

libyuv0-32bit

SUSE Linux Enterprise Module for Desktop Applications 15 SP7SUSE Linux Enterprise Server 15 SP6SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

20230517+a377993-150600.3.4.2

References

https://bugzilla.suse.com/1263678

https://bugzilla.suse.com/1268242

https://bugzilla.suse.com/1268650

https://bugzilla.suse.com/1268651

https://bugzilla.suse.com/1268653

https://bugzilla.suse.com/1268655

https://lists.suse.com/pipermail/sle-updates/2026-July/048666.html

https://www.suse.com/security/cve/CVE-2026-56208/

https://www.suse.com/security/cve/CVE-2026-56209/

https://www.suse.com/security/cve/CVE-2026-56210/

https://www.suse.com/security/cve/CVE-2026-56211/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2026/suse-su-20263224-1/

CVSS Analysis

CVSS v3.1

8.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

HighI:H

Availability

HighA:H

8.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Upstream

CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211

Ecosystems(9)

SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Desktop Applications 15 SP7 SUSE Linux Enterprise Server 15 SP6

Timeline

PublishedJul 23, 2026

ModifiedJul 23, 2026