Theora vulnerabilities

2 known vulnerabilities in Theora from Xiph. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  Red Hat Enterprise Linux 10: Out-of-bounds Read

  CVE-2026-5673Apr 6, 2026Red Hat

  A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local attacker could exploit this by tricking a user into opening a sp

• 9.8 Critical severity

  Theora: Incorrect Authorization

  CVE-2024-56431Dec 25, 2024XiphEPSS 1.84%

  oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.