CVE-2019-19721
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player...
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
CVE-2019-19721- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-193, CWE-787
- Updated
- 2026-11-02
CVE List No score
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
CVE-2019-19721- Updated
- 2026-11-02
EUVDEUVD-2019-9325 No score
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
EUVD-2019-9325- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2wrf-hf7j-cx32
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player...
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
GHSA-2wrf-hf7j-cx32- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-193
- Updated
- 2026-11-02
OSV
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
CVE-2019-19721- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-19721
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
DEBIAN-CVE-2019-19721- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-19721
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
- Record
UBUNTU-CVE-2019-19721- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2020-0203 No score
Updated vlc packages fix security vulnerabilities
Multiple security issues were discovered in the microdns plugin of the VLC media player, which could result in denial of service or potentially the execution of arbitrary code via malicious mDNS packets (CVE-2020-6071, CVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079, CVE-2020-6080).
VLC has been updated to 3.0.10 to fix theese and other issues.
- Record
MGASA-2020-0203- Updated
- 2026-11-02
OSVUSN-6180-1 No score
vlc vulnerabilities
It was discovered that VLC could be made to read out of bounds when decoding image files. If a user were tricked into opening a crafted image file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)
It was discovered that VLC could be made to write out of bounds when processing H.264 video files. If a user were tricked into opening a crafted H.264 video file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-13428)
It was discovered that VLC could be made to read out of bounds when processing AVI video files. If a user were tricked into opening a crafted AVI video file, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801, CVE-2021-25802, CVE-2021-25803, CVE-2021-25804)
It was discovered that the VNC module of VLC contained an arithmetic overflow. If a user were tricked into opening a crafted playlist or connecting to a rouge VNC server, a remote attacker could possibly use this issue to cause VLC to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2022-41325)
- Record
USN-6180-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.9.2-1 | 3.0.9.2-1 |
vlcDebian:13 |
before 3.0.9.2-1 | 3.0.9.2-1 |
vlcDebian:14 |
before 3.0.9.2-1 | 3.0.9.2-1 |
vlcDebian:9 |
before 3.0.10-0+deb9u1, plus listed versions 2.2.6-12.2.6-1~deb9u12.2.6-22.2.6-32.2.6-4 Show 45 moreShow less2.2.6-52.2.6-62.2.7-12.2.7-1~deb8u12.2.7-1~deb9u12.2.8-12.2.8-23.0.0-13.0.0~rc1-13.0.0~rc1~20171206-13.0.0~rc1~20171210-13.0.0~rc1~20171210-23.0.0~rc2-13.0.0~rc2-23.0.0~rc4-13.0.0~rc4-23.0.0~rc4-33.0.0~rc5-13.0.0~rc6-13.0.0~rc7-13.0.0~rc7-23.0.0~rc8-13.0.1-13.0.1-23.0.1-33.0.2-0+deb9u13.0.2-13.0.2-1+0.riscv64.13.0.2-1+0.riscv64.23.0.3-13.0.3-1+0.riscv64.13.0.3-1+b1+0.riscv64.13.0.3-1-0+deb9u13.0.3-1-13.0.3-1-23.0.3-1-33.0.3-1-43.0.3-23.0.4-13.0.4-23.0.4-33.0.4-43.0.5-13.0.5-23.0.6-0+deb9u1 |
3.0.10-0+deb9u1 |
vlcDebian:10 |
before 3.0.10-0+deb10u1, plus listed versions 3.0.7-13.0.7.1-13.0.7.1-23.0.7.1-33.0.8-0+deb10u1 Show 5 moreShow less3.0.8-13.0.8-23.0.8-33.0.8-43.0.9.2-1 |
3.0.10-0+deb10u1 |
vlcMageia:7 |
before 3.0.10-1.mga7 | 3.0.10-1.mga7 |
vlcMageia:7 |
before 3.0.10-1.mga7.tainted | 3.0.10-1.mga7.tainted |
vlcUbuntu:Pro:16.04:LTS |
before 2.2.2-5ubuntu0.16.04.5+esm2, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 8 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm1 |
2.2.2-5ubuntu0.16.04.5+esm2 |
vlcUbuntu:Pro:18.04:LTS |
before 3.0.8-0ubuntu18.04.1+esm1, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 20 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.23.0.7.1-0ubuntu18.04.13.0.8-0ubuntu18.04.1 |
3.0.8-0ubuntu18.04.1+esm1 |
vlcUbuntu:Pro:20.04:LTS |
before 3.0.9.2-1ubuntu0.1~esm1, plus listed versions 3.0.8-23.0.8-2build13.0.8-33.0.8-3build13.0.8-3build23.0.8-3build43.0.8-43.0.9.2-1 |
3.0.9.2-1ubuntu0.1~esm1 |
vlcUbuntu:Pro:22.04:LTS |
before 3.0.16-1ubuntu0.1~esm1, plus listed versions 3.0.16-13.0.16-1build13.0.16-1build23.0.16-1build33.0.16-1build43.0.16-1build53.0.16-1build7 |
3.0.16-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19721 is a high vulnerability (CVSS 7.8) in Videolan Vlc Media Player, published April 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in vlc 3.0.9.2-1.
References
videolan.org/security
hg.libsdl.org/SDL_image
bugs.gentoo.org/721940
git.videolan.org?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b
nvd.nist.gov/vuln/detail/CVE-2019-19721
Show 16 moreShow less
github.com/advisories/GHSA-2wrf-hf7j-cx32
security-tracker.debian.org/tracker/CVE-2019-19721
advisories.mageia.org/MGASA-2020-0203.html
bugs.mageia.org/show_bug.cgi?id=26467
debian.org/security/2020/dsa-4671
ubuntu.com/security/CVE-2019-19721
cve.org/CVERecord?id=CVE-2019-19721
Left out here: 12 versions. The JSON record has them.