CVE-2024-56431

The libtheora library, used in Theora through version 1.0 7180717 , contains an invalid negative left shift within the oc_huff_tree_unpack function in huffdec.c. While this is a technical flaw, third parties have disputed the existence of a security impact, noting that applications may not crash....

CVE-2026-5673

CVE-2026-5673 affects libtheora’s AVI parser. The flaw is a heap-based out-of-bounds read in the avi_parse_input_file() function triggered by a crafted AVI file with a truncated header sub-chunk. Local attackers can exploit this by tricking a user into opening such a file, leading to a potential ...