oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade thunderbirdUpgrade thunderbird-debuginfoUpgrade firefox-debuginfoUpgrade firefox | Apr 17, 2025 | Dec 25, 2024 |
| Debian | — | Upgrade libtheoraNo solution exists | May 15, 2025 | Dec 25, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libtheora-helpUpgrade libtheora | Jul 11, 2025 | Dec 25, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libtheora-helpUpgrade libtheora | Sep 15, 2025 | Jul 10, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub