CVE-2019-5439
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further...
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
CVE-2019-5439- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-120, CWE-119
- Updated
- 2026-11-02
CVE List No score
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
CVE-2019-5439- Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2019-15027 No score
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
EUVD-2019-15027- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r9hw-7j54-8fpw
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further...
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
GHSA-r9hw-7j54-8fpw- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-119, CWE-120
- Updated
- 2026-11-02
OSV
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
CVE-2019-5439- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-04
OSVDEBIAN-CVE-2019-5439
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
DEBIAN-CVE-2019-5439- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
Show 7 moreShow less
OSVUBUNTU-CVE-2019-5439
A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.
- Record
UBUNTU-CVE-2019-5439- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1840-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
- Record
openSUSE-SU-2019:1840-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1897-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2019:1897-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1909-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
New package libaom:
- Initial version 1.0.0
- A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
- Record
openSUSE-SU-2019:1909-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2015-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
New package libaom:
- Initial version 1.0.0
- A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2015-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11502-1 No score
libvlc5-3.0.16-1.5 on GA media
These are all security issues fixed in the libvlc5-3.0.16-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11502-1- Updated
- 2026-11-02
OSVUSN-4074-1 No score
vlc vulnerabilities
It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted CAF file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857)
It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted MKV file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874)
It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted MP4 file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13602)
It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted AVI file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5439)
- Record
USN-4074-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:13 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:14 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:9 |
before 3.0.7-0+deb9u1, plus listed versions 2.2.6-12.2.6-1~deb9u12.2.6-22.2.6-32.2.6-4 Show 45 moreShow less2.2.6-52.2.6-62.2.7-12.2.7-1~deb8u12.2.7-1~deb9u12.2.8-12.2.8-23.0.0-13.0.0~rc1-13.0.0~rc1~20171206-13.0.0~rc1~20171210-13.0.0~rc1~20171210-23.0.0~rc2-13.0.0~rc2-23.0.0~rc4-13.0.0~rc4-23.0.0~rc4-33.0.0~rc5-13.0.0~rc6-13.0.0~rc7-13.0.0~rc7-23.0.0~rc8-13.0.1-13.0.1-23.0.1-33.0.2-0+deb9u13.0.2-13.0.2-1+0.riscv64.13.0.2-1+0.riscv64.23.0.3-13.0.3-1+0.riscv64.13.0.3-1+b1+0.riscv64.13.0.3-1-0+deb9u13.0.3-1-13.0.3-1-23.0.3-1-33.0.3-1-43.0.3-23.0.4-13.0.4-23.0.4-33.0.4-43.0.5-13.0.5-23.0.6-0+deb9u1 |
3.0.7-0+deb9u1 |
vlcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 11 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm32.2.2-5ubuntu0.16.04.5+esm4 |
None known |
vlcUbuntu:18.04:LTS |
before 3.0.7.1-0ubuntu18.04.1, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 18 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.2 |
3.0.7.1-0ubuntu18.04.1 |
vlcopenSUSE:Leap 15.1 |
before 3.0.7.1-lp151.6.3.1 | 3.0.7.1-lp151.6.3.1 |
vlcSUSE:Package Hub 15 SP1 |
before 3.0.7.1-bp151.5.3.3 | 3.0.7.1-bp151.5.3.3 |
libaomopenSUSE:Leap 15.0 |
before 1.0.0-lp150.2.1 | 1.0.0-lp150.2.1 |
vlcopenSUSE:Leap 15.0 |
before 3.0.7.1-lp150.8.1 | 3.0.7.1-lp150.8.1 |
libaomSUSE:Package Hub 15 |
before 1.0.0-bp150.2.1 | 1.0.0-bp150.2.1 |
vlcSUSE:Package Hub 15 |
before 3.0.7.1-bp150.2.6.1 | 3.0.7.1-bp150.2.6.1 |
vlcopenSUSE:Tumbleweed |
before 3.0.16-1.5 | 3.0.16-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, products | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-5439 is a medium vulnerability (CVSS 6.5) in Videolan Vlc Media Player, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.29%, the 92nd percentile. Fixed in vlc 3.0.7-1.
References
hackerone.com/reports/484398
securityfocus.com/bid/108769
usn.ubuntu.com/4074-1
lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html
Show 45 moreShow less
security.gentoo.org/glsa/201908-23
nvd.nist.gov/vuln/detail/CVE-2019-5439
github.com/advisories/GHSA-r9hw-7j54-8fpw
security-tracker.debian.org/tracker/CVE-2019-5439
ubuntu.com/security/CVE-2019-5439
jbkempf.com/blog/post/2019/VLC-3.0.7-and-security
cve.org/CVERecord?id=CVE-2019-5439
bugzilla.suse.com/1118586
suse.com/security/cve/CVE-2018-19857
Left out here: 1 version. The JSON record has them.