CVE-2026-5673

CVE-2026-5673 is a heap-based out-of-bounds read vulnerability in libtheora's AVI parser, specifically within the avi_parse_input_file() function. An attacker could exploit this flaw by crafting a malicious AVI file with a truncated header sub-chunk that, when opened by a user, triggers the vulnerability. This affects any application or service that uses libtheora to process audio-video content. The vulnerability is rated MEDIUM severity (CVSS 5.6) with a local attack vector requiring low complexity and user interaction to exploit. While the attack complexity is minimal, it requires local access and relies on social engineering to convince a user to open a malicious file. The impact is notable, with potential for application denial-of-service crashes or unauthorized disclosure of sensitive heap memory information. There is currently no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities catalog, and it remains inactive on industry hot-lists. With an EPSS score of 0.00005, this CVE ranks lower than 99.98% of vulnerabilities in terms of exploitation likelihood, suggesting minimal community attention and no publicly available proof-of-concept code at this time.