A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the aviparseinputfile() function. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file containing a truncated header sub-chunk. This could lead to a denial-of-service (application crash) or potentially leak sensitive information from the heap.

A heap-based out-of-bounds read flaw was found in libtheora within the aviparseinputfile() function in avilib.c. The vulnerability occurs when the AVI parser processes a malformed file containing a truncated hdrl sub-chunk. Because the parser lacks sufficient length validation before performing fixed-offset memcpy operations (such as copying the compressor field), it can be triggered to read past the end of the hdrldata buffer. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file, leading to a denial-of-service (application crash) or potentially leaking information from the heap.