medium5.6
CVE-2026-5673
A flaw was found in libtheora.
Impact
A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xiph | Theora | All versions |
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0, 9.0, 10.0 |