CVE-2019-12874
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC...
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
CVE-2019-12874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
CVE-2019-12874- Updated
- 2026-11-02
EUVDEUVD-2019-4453 No score
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
EUVD-2019-4453- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hjrf-5287-583q
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC...
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
GHSA-hjrf-5287-583q- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSV
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
CVE-2019-12874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
OSVDEBIAN-CVE-2019-12874
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
DEBIAN-CVE-2019-12874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 6 moreShow less
OSVUBUNTU-CVE-2019-12874
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
- Record
UBUNTU-CVE-2019-12874- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1840-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
- Record
openSUSE-SU-2019:1840-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1897-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
This update was imported from the openSUSE:Leap:15.1:Update update project.
- Record
openSUSE-SU-2019:1897-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1909-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
New package libaom:
- Initial version 1.0.0
- A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
- Record
openSUSE-SU-2019:1909-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2015-1 No score
Security update for vlc
This update for vlc to version 3.0.7.1 fixes the following issues:
Security issues fixed:
- CVE-2019-5439: Fixed a buffer overflow (bsc#1138354).
- CVE-2019-5459: Fixed an integer underflow (bsc#1143549).
- CVE-2019-5460: Fixed a double free (bsc#1143547).
- CVE-2019-12874: Fixed a double free in zlib_decompress_extra in modules/demux/mkv/util.cpp (bsc#1138933).
- CVE-2019-13602: Fixed an integer underflow in mp4 demuxer (boo#1141522).
- CVE-2019-13962: Fixed a heap-based buffer over-read in avcodec (boo#1142161).
Non-security issues fixed:
- Video Output:
- Fix hardware acceleration with some AMD drivers
- Improve direct3d11 HDR support
- Access:
- Improve Blu-ray support
- Audio output:
- Fix pass-through on Android-23
- Fix DirectSound drain
- Demux: Improve MP4 support
- Video Output:
- Fix 12 bits sources playback with Direct3D11
- Fix crash on iOS
- Fix midstream aspect-ratio changes when Windows hardware decoding is on
- Fix HLG display with Direct3D11
- Stream Output: Improve Chromecast support with new ChromeCast apps
- Misc:
- Update Youtube, Dailymotion, Vimeo, Soundcloud scripts
- Work around busy looping when playing an invalid item with loop enabled
- Updated translations.
New package libaom:
- Initial version 1.0.0
- A library for AOMedia Video 1 (AV1), an open, royalty-free video coding format designed for video transmissions over the Internet.
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2015-1- Updated
- 2026-11-02
OSVUSN-4074-1 No score
vlc vulnerabilities
It was discovered that the VLC CAF demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted CAF file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-19857)
It was discovered that the VLC Matroska demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted MKV file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-12874)
It was discovered that the VLC MP4 demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted MP4 file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-13602)
It was discovered that the VLC AVI demuxer incorrectly handled certain files. If a user were tricked into opening a specially-crafted AVI file, a remote attacker could use this issue to cause VLC to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2019-5439)
- Record
USN-4074-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vlcDebian:12 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:13 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:14 |
before 3.0.7-1 | 3.0.7-1 |
vlcDebian:9 |
before 3.0.7-0+deb9u1, plus listed versions 2.2.6-12.2.6-1~deb9u12.2.6-22.2.6-32.2.6-4 Show 45 moreShow less2.2.6-52.2.6-62.2.7-12.2.7-1~deb8u12.2.7-1~deb9u12.2.8-12.2.8-23.0.0-13.0.0~rc1-13.0.0~rc1~20171206-13.0.0~rc1~20171210-13.0.0~rc1~20171210-23.0.0~rc2-13.0.0~rc2-23.0.0~rc4-13.0.0~rc4-23.0.0~rc4-33.0.0~rc5-13.0.0~rc6-13.0.0~rc7-13.0.0~rc7-23.0.0~rc8-13.0.1-13.0.1-23.0.1-33.0.2-0+deb9u13.0.2-13.0.2-1+0.riscv64.13.0.2-1+0.riscv64.23.0.3-13.0.3-1+0.riscv64.13.0.3-1+b1+0.riscv64.13.0.3-1-0+deb9u13.0.3-1-13.0.3-1-23.0.3-1-33.0.3-1-43.0.3-23.0.4-13.0.4-23.0.4-33.0.4-43.0.5-13.0.5-23.0.6-0+deb9u1 |
3.0.7-0+deb9u1 |
vlcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2.1-32.2.1-52.2.2-12.2.2-22.2.2-3 Show 11 moreShow less2.2.2-3build12.2.2-42.2.2-52.2.2-5ubuntu0.16.04.12.2.2-5ubuntu0.16.04.22.2.2-5ubuntu0.16.04.32.2.2-5ubuntu0.16.04.42.2.2-5ubuntu0.16.04.5+esm12.2.2-5ubuntu0.16.04.5+esm22.2.2-5ubuntu0.16.04.5+esm32.2.2-5ubuntu0.16.04.5+esm4 |
None known |
vlcUbuntu:18.04:LTS |
before 3.0.7.1-0ubuntu18.04.1, plus listed versions 2.2.6-62.2.6-6build12.2.7-12.2.8-12.2.8-1ubuntu4 Show 18 moreShow less2.2.8-23.0.0~rc1-1ubuntu13.0.0~rc1-1ubuntu33.0.0~rc2-1ubuntu13.0.0~rc2-2ubuntu13.0.0~rc2-2ubuntu23.0.0~rc4-1ubuntu13.0.0~rc7-2ubuntu13.0.0~rc8-1ubuntu13.0.0-1ubuntu13.0.1-1ubuntu53.0.1-2ubuntu13.0.1-2ubuntu23.0.1-33.0.1-3build13.0.2-0ubuntu0.13.0.3-1-1ubuntu13.0.4-1ubuntu0.2 |
3.0.7.1-0ubuntu18.04.1 |
vlcopenSUSE:Leap 15.1 |
before 3.0.7.1-lp151.6.3.1 | 3.0.7.1-lp151.6.3.1 |
vlcSUSE:Package Hub 15 SP1 |
before 3.0.7.1-bp151.5.3.3 | 3.0.7.1-bp151.5.3.3 |
libaomopenSUSE:Leap 15.0 |
before 1.0.0-lp150.2.1 | 1.0.0-lp150.2.1 |
vlcopenSUSE:Leap 15.0 |
before 3.0.7.1-lp150.8.1 | 3.0.7.1-lp150.8.1 |
libaomSUSE:Package Hub 15 |
before 1.0.0-bp150.2.1 | 1.0.0-bp150.2.1 |
vlcSUSE:Package Hub 15 |
before 3.0.7.1-bp150.2.6.1 | 3.0.7.1-bp150.2.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases | EUVD, OSV | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12874 is a critical vulnerability (CVSS 9.8) in Videolan Vlc Media Player, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.39%, the 84th percentile. Fixed in vlc 3.0.7-1.
References
git.videolan.org?p=vlc.git%3Ba=commit%3Bh=81023659c7de5ac2637b4a879195efef50846102
securityfocus.com/bid/108882
usn.ubuntu.com/4074-1
lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html
Show 33 moreShow less
security.gentoo.org/glsa/201908-23
nvd.nist.gov/vuln/detail/CVE-2019-12874
github.com/advisories/GHSA-hjrf-5287-583q
security-tracker.debian.org/tracker/CVE-2019-12874
ubuntu.com/security/CVE-2019-12874
cve.org/CVERecord?id=CVE-2019-12874
bugzilla.suse.com/1118586
suse.com/security/cve/CVE-2018-19857
Left out here: 1 version. The JSON record has them.