This vulnerability in libtheora's AVI parser allows a local attacker to cause a heap-based out-of-bounds read by providing a malformed AVI file containing a truncated header sub-chunk. The issue resides in the avi_parse_input_file() function. Successful exploitation requires tricking a user into opening the crafted file, leading to denial-of-service or potential information disclosure from heap memory. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, user interaction needed, unchanged scope, low confidentiality impact, no integrity impact, and high availability impact. Red Hat Enterprise Linux 10 is affected. No patch or official remediation guidance is currently provided in the vendor advisory.

The vulnerability can cause application crashes (denial-of-service) or potentially leak sensitive information from heap memory when a specially crafted AVI file is opened. The impact is limited to local users who can trick others into opening malicious files. There is no indication of remote exploitation or integrity compromise. The CVSS score of 5.6 reflects medium severity with significant availability impact but limited confidentiality impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-5673 for current remediation guidance. Until a patch is available, users should avoid opening untrusted or suspicious AVI files. No official fix or temporary workaround is currently documented by Red Hat.