{"id":"CVE-2026-5673","aliases":["DEBIAN-CVE-2026-5673","EUVD-2026-19219","GHSA-cjcp-vc46-rm2h","OESA-2026-2210","ROOT-OS-DEBIAN-13-CVE-2026-5673","UBUNTU-CVE-2026-5673"],"status":"published","title":"Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00181,"percentile":0.07747,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-04-06T09:22:36Z","modified":"2026-11-05T21:43:01Z","fixes":[{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libtheora","fixed_in":["1.1.1-26.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libtheora","fixed_in":["1.1.1-27.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libtheora","fixed_in":["1.1.1-29.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libtheora","fixed_in":["1.1.1-29.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"libtheora","fixed_in":["1.1.1-29.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"libtheora","fixed_in":["1.2.0~alpha1+dfsg-6.aikido.3","1.2.0~alpha1+dfsg-6.aikido.2","1.2.0~alpha1+dfsg-6.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-libtheora","fixed_in":["1.2.0~alpha1+dfsg-6.aikido.3","1.2.0~alpha1+dfsg-6.aikido.2","1.2.0~alpha1+dfsg-6.root.io.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1+dfsg.1-16.1","1.1.1+dfsg.1-16.1+deb12u1","1.1.1+dfsg.1-17","1.2.0+dfsg-1","1.2.0+dfsg-2","1.2.0+dfsg-3","1.2.0+dfsg-4","1.2.0+dfsg-5","1.2.0+dfsg-6","1.2.0~alpha1+dfsg-1","1.2.0~alpha1+dfsg-2","1.2.0~alpha1+dfsg-3","1.2.0~alpha1+dfsg-4","1.2.0~alpha1+dfsg-5","1.2.0~alpha1+dfsg-6"]},{"source":"osv","ecosystem":"Debian:13","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0+dfsg-1","1.2.0+dfsg-2","1.2.0+dfsg-3","1.2.0+dfsg-4","1.2.0+dfsg-5","1.2.0+dfsg-6","1.2.0~alpha1+dfsg-6"]},{"source":"osv","ecosystem":"Debian:14","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0+dfsg-1","1.2.0+dfsg-2","1.2.0+dfsg-3","1.2.0+dfsg-4","1.2.0+dfsg-5","1.2.0+dfsg-6","1.2.0~alpha1+dfsg-6"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-26.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-27.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-29.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-29.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-29.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0~alpha1+dfsg-6.aikido.3"},{"fixed":"1.2.0~alpha1+dfsg-6.aikido.2"},{"fixed":"1.2.0~alpha1+dfsg-6.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-libtheora","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0~alpha1+dfsg-6.aikido.3"},{"fixed":"1.2.0~alpha1+dfsg-6.aikido.2"},{"fixed":"1.2.0~alpha1+dfsg-6.root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0.0-1build1","2.6.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.2.0-2","8.5.1-1","8.5.2-1","8.6.0-1","8.6.1-1","8.7.0-1","8.8.0-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-0ubuntu1","1.0.1-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-2","2.6.1.0-2build1","2.6.1.0-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.0.0-1","15.0.0-1build1","17.0.0-2","18.0.0-1","19.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-5build1","2.6.1.0-6","2.6.1.0-6build1","2.6.1.0-6build2","2.6.1.0-6build3","2.6.1.0-6build4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["37.0.0-1build1","38.0.0-1","39.0.0-1","40.0.0-1","40.0.0-3","41.0.0-1","42.0.0-1","43.0.0-1","43.0.0-1ubuntu1","43.0.0-1ubuntu2","44.0.0-1ubuntu1","45.0.0-1ubuntu1","45.0.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-1build2","1.0.1-2","1.0.1-2build1","1.0.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-7build3","2.6.1.0-8","2.6.1.0-8build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["60.0.0-2","62.0.0-1build1","63.0.0-1","64.0.0-1","65.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-9build2","2.6.1.0-9build3","2.6.1.0-9build4","2.6.1.0-9build5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.0-2","79.0-1","80.0-1","81.0-1","81.0-1build1","82.0-1","82.0-1build1","82.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-9build5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["90.0-1build1","92.0-1","92.0-1build2","94.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-5","1.0.1-5build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-9build6"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["97.0-1build1","98.0-1","99.0-1","100.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-5build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"asc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.1.0-9build5","2.6.1.0-9build6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mkvtoolnix","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["94.0-1","95.0-1","96.0-1","97.0-1","97.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ogmrip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1-5build1","1.0.1-5build2"]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"xiph","product":"theora"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-5673","tags":["vdb-entry","x_refsource_REDHAT","Third Party Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455340","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Third Party Advisory"]},{"url":"https://github.com/xiph/theora/issues/24","tags":["Exploit","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5673","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cjcp-vc46-rm2h"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5673","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2210","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5673","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5673","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-5673","title":"Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T09:22:36.227Z","modified":"2026-11-05T21:43:01.911Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-19219","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T09:22:36Z","modified":"2026-11-05T21:43:01Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-05T23:02:20.394374Z"}],"ghsa":[{"id":"GHSA-cjcp-vc46-rm2h","title":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the...","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T12:32:09Z","modified":"2026-04-06T12:32:12Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:07:10.409602Z"}],"nvd":[{"id":"CVE-2026-5673","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T10:16:03.4Z","modified":"2026-11-05T22:18:50.46Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-05T23:57:17.922269Z"}],"osv":[{"id":"DEBIAN-CVE-2026-5673","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T10:16:03.4Z","modified":"2026-10-27T09:47:34.460969936Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-2210","title":"libtheora security update","description":"Theora is a free and open video compression format from the Xiph.org Foundation. Like all our multimedia technology it can be used to distribute film and video online and on disc without the licensing and royalty fees or vendor lock-in associated with other formats.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.(CVE-2026-5673)","status":"published","published":"2026-05-09T11:11:11Z","modified":"2026-08-18T01:19:51.877098663Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.087701Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-5673","title":"CVE-2026-5673 in libtheora - Patched by Root","description":"Root has patched CVE-2026-5673 in the libtheora package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:13:49Z","modified":"2026-08-24T18:45:16.393422135Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"UBUNTU-CVE-2026-5673","description":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.","status":"published","published":"2026-04-06T10:16:00Z","modified":"2026-10-17T12:59:10.617500865Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H","level":"medium"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.382716Z"}]}}