cbcvebase.
CVE-2026-5673
published 2026-04-06

CVE-2026-5673: A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the…

high7.1CVSS 3.1
AVLACLPRNUIRSUCHINAH
A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.

Affected

6 ranges
VendorProductVersion rangeFixed in
debianlibtheora——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——
redhatenterprise_linux——

CVSS provenance

nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
osv5.6MEDIUM