Every CVE Search/ Get API key

CVE-2024-56431

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid...

9.8 CriticalPublic exploitFix availableDisputed

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.84%Up 1.8 points since Dec 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
CVE-2024-56431
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2024-53141 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
EUVD-2024-53141
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-8xp8-gmmj-xc8w 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid...

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.

Record
GHSA-8xp8-gmmj-xc8w
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
NVD 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
CVE-2024-56431
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-863
Updated
2026-11-02
OSV 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
CVE-2024-56431
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2024-56431 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
DEBIAN-CVE-2024-56431
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVOESA-2025-1369 9.8

libtheora security update

Theora is a free and open video compression format from the Xiph.org Foundation. Like all our multimedia technology it can be used to distribute film and video online and on disc without the licensing and royalty fees or vendor lock-in associated with other formats.

Security Fix(es):

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift.(CVE-2024-56431)

Record
OESA-2025-1369
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-56431 9.8

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Record
UBUNTU-CVE-2024-56431
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2025:0147-1 No score

Security update for mozjs102

This update for mozjs102 fixes the following issue:

  • CVE-2024-56431: avoid negative shift in huffdec.c (bsc#1234837).
Record
openSUSE-SU-2025:0147-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14957-1 No score

libtheora-devel-1.2.0-1.1 on GA media

These are all security issues fixed in the libtheora-devel-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14957-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15002-1 No score

libmozjs-115-0-115.15.0-5.1 on GA media

These are all security issues fixed in the libmozjs-115-0-115.15.0-5.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15002-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15009-1 No score

libmozjs-128-0-128.9.0-2.1 on GA media

These are all security issues fixed in the libmozjs-128-0-128.9.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15009-1
Updated
2026-11-02
OSVSUSE-SU-2025:1287-1 No score

Security update for mozjs52

This update for mozjs52 fixes the following issues:

  • CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837).
Record
SUSE-SU-2025:1287-1
Updated
2026-11-02
OSVSUSE-SU-2025:1288-1 No score

Security update for mozjs52

This update for mozjs52 fixes the following issues:

  • CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837).
Record
SUSE-SU-2025:1288-1
Updated
2026-11-02
OSVSUSE-SU-2025:1340-1 No score

Security update for mozjs52

This update for mozjs52 fixes the following issues:

  • CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837).
Record
SUSE-SU-2025:1340-1
Updated
2026-11-02
OSVSUSE-SU-2025:1365-1 No score

Security update for mozjs60

This update for mozjs60 fixes the following issues:

  • CVE-2024-56431: Fixed a negative shift in huffdec.c (bsc#1234837).
Record
SUSE-SU-2025:1365-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libtheora
Debian:13
 before 1.2.0~alpha1+dfsg-6
1.2.0~alpha1+dfsg-6
libtheora
Debian:14
 before 1.2.0~alpha1+dfsg-6
1.2.0~alpha1+dfsg-6
libtheora
openEuler:20.03-LTS-SP4
 before 1.1.1-25.oe2003sp4
1.1.1-25.oe2003sp4
libtheora
openEuler:22.03-LTS-SP3
 before 1.1.1-26.oe2203sp3
1.1.1-26.oe2203sp3
libtheora
openEuler:22.03-LTS-SP4
 before 1.1.1-26.oe2203sp4
1.1.1-26.oe2203sp4
libtheora
openEuler:24.03-LTS
 before 1.1.1-28.oe2403sp1
1.1.1-28.oe2403sp1
libtheora
openEuler:24.03-LTS-SP1
 before 1.1.1-28.oe2403sp1
1.1.1-28.oe2403sp1
mozjs52
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 52.6.0-150000.3.6.1
52.6.0-150000.3.6.1
mozjs52
openSUSE:Leap 15.6
 before 52.6.0-150000.3.6.1
52.6.0-150000.3.6.1
mozjs78
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 78.15.0-150400.3.14.1
78.15.0-150400.3.14.1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
mozjs78
openSUSE:Leap 15.6
 before 78.15.0-150400.3.14.1
78.15.0-150400.3.14.1
mozjs115
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
 before 115.4.0-150600.3.9.1
115.4.0-150600.3.9.1
mozjs115
openSUSE:Leap 15.6
 before 115.4.0-150600.3.9.1
115.4.0-150600.3.9.1
mozjs60
SUSE:Linux Enterprise Micro 5.3
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
SUSE:Linux Enterprise Micro 5.4
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
SUSE:Linux Enterprise Module for Basesystem 15 SP6
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
SUSE:Linux Enterprise Module for Desktop Applications 15 SP6
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
SUSE:Linux Enterprise Micro 5.1
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
SUSE:Linux Enterprise Micro 5.2
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs60
openSUSE:Leap 15.6
 before 60.9.0-150200.6.3.1
60.9.0-150200.6.3.1
mozjs102
SUSE:Package Hub 15 SP6
 before 102.15.1-bp156.3.3.1
102.15.1-bp156.3.3.1
mozjs102
openSUSE:Leap 15.6
 before 102.15.1-bp156.3.3.1
102.15.1-bp156.3.3.1
libtheora
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.2.0-1.1
1.2.0-1.1
mozjs115
openSUSE:Tumbleweed
 before 115.15.0-5.1
115.15.0-5.1
mozjs128
openSUSE:Tumbleweed
 before 128.9.0-2.1
128.9.0-2.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubUnionTech-Software/libtheora-CVE-2024-56431-PoC2024-12-25

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-56431 is a critical vulnerability (CVSS 9.8) in Xiph Theora, published December 25, 2024. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in libtheora 1.2.0~alpha1+dfsg-6.

References

Show 15 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open