CVE-2024-56431: Xiph Theora

Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days.

oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because there is no evidence of a security impact, e.g., an application would not crash.

Affected products

• Xiph Theora: before 1.2.0 (fixed in 1.2.0)

Published 2024-12-25. Last modified 2026-06-17.