CVE-2026-5673: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-5673 is a heap-based out-of-bounds read vulnerability in libtheora's AVI parser, specifically within the avi_parse_input_file() function in avilib.c. A local attacker can exploit this by tricking a user into opening a specially crafted AVI file containing a truncated hdrl header sub-chunk, potentially causing a denial-of-service (application crash) or leaking sensitive heap memory. The vulnerability was disclosed on April 6, 2026, and affects the xiph/theora library as shipped in Red Hat Enterprise Linux versions 6.0, 7.0, 8.0, 9.0, and 10.0. It carries a CVSS v3.1 base score of 7.1 (High) per NVD, or 5.6 (Moderate) per the GitHub Advisory Database (Red Hat CVE, Github Advisory).

The root cause is an out-of-bounds read (CWE-125) in the AVI parser's hdrl sub-chunk processing logic. When parsing a malformed AVI file with a truncated hdrl sub-chunk, the parser performs fixed-offset memcpy operations — such as memcpy(AVI->compressor, hdrl_data+i+4, 4) — without first validating that sufficient bytes remain in the hdrl_data buffer, which was allocated via malloc(n). This allows reads past the end of the allocated heap region. Exploitation requires user interaction (opening a malicious file) and local access, but no privileges are required. A public proof-of-concept harness using AddressSanitizer (ASAN) is available on the xiph/theora GitHub issue tracker, demonstrating the crash (Red Hat Bugzilla, Theora Issue #24).

Successful exploitation can result in a denial-of-service via application crash or disclosure of sensitive data from heap memory. Because the out-of-bounds read occurs in a media parsing library, any application that uses libtheora to process AVI files is potentially affected. There is no integrity impact, and the scope is limited to the affected application process; lateral movement potential is low, but heap memory disclosure could expose in-memory secrets or data from co-located allocations (Red Hat CVE, Github Advisory).

A proof-of-concept exploit (a minimal C harness with ASAN instrumentation and a malformed AVI test file) is publicly available on the xiph/theora GitHub issue tracker, filed on March 21, 2026 (Theora Issue #24). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 305062 is available for scanning (Tenable).

1. Craft a malicious AVI file: Create an AVI file with a truncated hdrl sub-chunk (specifically a strh chunk shorter than the minimum required length), such that fixed-offset reads in the parser will exceed the allocated buffer. The PoC file avilib_hdrl_short_strh.avi demonstrates this structure.
2. Social engineering: Deliver the malicious AVI file to a target user via email attachment, file share, or web download, and convince them to open it with an application that uses libtheora for AVI parsing.
3. Trigger parsing: When the user opens the file, the application calls AVI_open_input_file(), which invokes avi_parse_input_file(). The parser allocates hdrl_data via malloc(n) and then performs memcpy(AVI->compressor, hdrl_data+i+4, 4) without validating remaining buffer length.
4. Achieve impact: The out-of-bounds read either crashes the application (DoS) or, depending on heap layout, reads adjacent heap memory that may contain sensitive data such as credentials, keys, or other in-memory content (Theora Issue #24, Red Hat Bugzilla).

• File System: Presence of unexpected or suspicious .avi files in user download directories, temporary folders, or email attachment staging areas; files with anomalously small or malformed hdrl chunk sizes detectable via AVI structure analysis tools.
• Logs: Application crash logs or core dumps from media player or transcoder processes referencing avi_parse_input_file() or avilib.c; ASAN output showing heap-buffer-overflow in memcpy within the AVI parser.
• Process: Unexpected crashes or segmentation faults in applications linked against libtheora when processing AVI files; processes terminating with signal 6 (SIGABRT) or signal 11 (SIGSEGV) during media file open operations (Theora Issue #24).

Apply security updates for libtheora as soon as they become available from Red Hat or the upstream xiph/theora project; a patch is confirmed available (Red Hat CVE, Github Advisory). As a workaround, restrict users from opening AVI files from untrusted sources, and consider implementing file type validation and sandboxing for media file processing pipelines. Organizations running Red Hat Enterprise Linux 6–10 should monitor Red Hat errata for updated libtheora packages and prioritize patching systems where media file processing from untrusted sources is common.

The vulnerability was reported to the xiph/theora project via GitHub Issues on March 21, 2026, by researcher "BreakingBad6," who provided a detailed PoC harness and suggested fixes including bounds validation before all fixed-offset accesses in hdrl sub-chunk parsing (Theora Issue #24). Red Hat assigned the bug moderate severity and opened tracking in Bugzilla. The Yocto Project security mailing list also discussed the issue in May and June 2026, indicating awareness in the embedded Linux community (Yocto Security List).