A heap-based out-of-bounds read flaw was found in libtheora within the avi_parse_input_file() function in avilib.c. The vulnerability occurs when the AVI parser processes a malformed file containing a truncated hdrl sub-chunk. Because the parser lacks sufficient length validation before performing fixed-offset memcpy operations (such as copying the compressor field), it can be triggered to read past the end of the hdrl_data buffer. A local attacker could exploit this by tricking a user into opening a specially crafted AVI file, leading to a denial-of-service (application crash) or potentially leaking information from the heap.