Xiph vulnerabilities
We track 4 vulnerabilities in Xiph products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on April 6, 2026.
Latest Xiph vulnerabilities
- 7.1 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a sp
- 9.8 Critical severity
Theora: Incorrect Authorization
oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.
- 7.8 High severity
Vorbis-tools: Out-of-bounds Write
Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during the conversion of wav files to ogg files.
- 7.8 High severity
Opusfile: NULL Pointer Dereference
A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.