{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"libtheora","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NT20ZX1MVB3XNX335FVRZ9","modified_at":"2026-10-27T09:47:34.460969936Z","published_at":"2026-04-06T10:16:03.400Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-5673","https://security-tracker.debian.org/tracker/CVE-2026-5673"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-5673#Debian:13/libtheora","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-5673"}],"summary":"A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Interleave) parser, specifically in the avi_parse_input_file() function. A local atta"}