oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade thunderbirdUpgrade firefox | Apr 17, 2025 | Dec 25, 2024 |
| Debian | — | Upgrade libtheora | May 15, 2025 | Dec 25, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libtheoraUpgrade libtheora-help | Jul 11, 2025 | Dec 25, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtheora-helpUpgrade libtheora | Sep 15, 2025 | Jul 10, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub