Red Hat Enterprise Linux 10 CVE-2026-5673

The CVSS v3.1 score of 5.6 (Medium) reflects a local attack vector with low complexity and required limited privileges, but the impact assessment shows contradictions worth analyzing. The vector (AV:L/AC:L/PR:L/UI:R) indicates local access only, requiring user interaction (UI:R), which significantly constrains real-world exploitability. The confidentiality impact (C:L) is limited, integrity is none (I:N), and availability impact is high (A:H), correctly capturing crash potential but not remote execution. The CVSS scoring appropriately reflects that this is primarily a denial-of-service and limited information disclosure risk rather than a critical vulnerability. Without EPSS data or KEV status confirmation, the baseline assessment treats this as a medium-priority issue affecting media processing workflows where untrusted AVI files may be processed. The requirement for local access and user interaction to open a crafted file significantly reduces attack surface in production server environments, though desktop/media players running as unprivileged users remain at risk. Information disclosure potential is limited to heap contents readable by the same privilege level.

A user receives a malicious AVI file via email or downloads it from a compromised website. When the user opens the file in a media player or processing application (such as ffmpeg or Audacity), libtheora's AVI parser processes the header and encounters a truncated header sub-chunk. The avi_parse_input_file() function reads beyond the allocated buffer in heap memory, either crashing the application (denial-of-service) or exposing sensitive data (such as adjacent heap objects, potentially containing media metadata or application secrets). The attack requires the victim's active participation to open the file, limiting opportunistic exploitation but making it effective in targeted scenarios against specific users or organizations known to process video files.