A heap‑based out‑of‑bounds read vulnerability exists in libtheora’s AVI parser. An attacker can craft a malformed AVI file that causes the parser to read beyond allocated memory. This can lead to an application crash, creating a denial‑of‑service condition, or leak sensitive data read from the process heap, exposing confidential information.

Red Hat Enterprise Linux 6, 7, 8, 9 and 10 contain the vulnerable libtheora package. Any system running these RHEL releases may be impacted if the library is in use by media applications that accept AVI files.

The CVSS score of 5.6 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Exploitation requires that a local user opens a specially crafted AVI file, so the attack vector is local through user interaction. If a malicious AVI file is delivered via phishing or distributed on shared media, the risk to end users is significant. The vulnerability does not provide remote code execution but can still cause service disruption or data leakage.