CVE-2019-14497
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap...
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
CVE-2019-14497- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
CVE-2019-14497- Updated
- 2026-11-02
EUVDEUVD-2019-5673 No score
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
EUVD-2019-5673- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-crmr-7fr2-cw8r
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap...
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
GHSA-crmr-7fr2-cw8r- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
CVE-2019-14497- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14497
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
DEBIAN-CVE-2019-14497- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14497
ModuleEditor::convertInstrument in tracker/ModuleEditor.cpp in MilkyTracker 1.02.00 has a heap-based buffer overflow.
- Record
UBUNTU-CVE-2019-14497- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4499-1 No score
MilkyTracker vulnerabilities
It was discovered that MilkyTracker did not properly handle certain input. If a user were tricked into opening a malicious file, an attacker could cause MilkyTracker to crash or potentially execute arbitrary code.
- Record
USN-4499-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
milkytrackerDebian:12 |
before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:13 |
before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:14 |
before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:8 From an advisory covering 3 CVEs |
before 0.90.85+dfsg-2.2+deb8u1, plus listed versions 0.90.85+dfsg-2.2 |
0.90.85+dfsg-2.2+deb8u1 |
milkytrackerDebian:9 From an advisory covering 4 CVEs |
before 0.90.86+dfsg-2+deb9u1, plus listed versions 0.90.86+dfsg-2 |
0.90.86+dfsg-2+deb9u1 |
milkytrackerUbuntu:16.04:LTS |
before 0.90.85+dfsg-2.2+deb8u1build0.16.04.1, plus listed versions 0.90.85+dfsg-2.2 |
0.90.85+dfsg-2.2+deb8u1build0.16.04.1 |
milkytrackerUbuntu:18.04:LTS |
All versions, plus listed versions 1.01.00+dfsg-11.01.00+dfsg-1build11.01.00+dfsg-21.02.00+dfsg-1 |
None known |
milkytrackerUbuntu:16.04:LTS From an advisory covering 3 CVEs |
before 0.90.85+dfsg-2.2+deb8u1build0.16.04.1, plus listed versions 0.90.85+dfsg-2.2 |
0.90.85+dfsg-2.2+deb8u1build0.16.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14497 is a high vulnerability (CVSS 7.8) in Milkytracker Project Milkytracker, published August 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in milkytracker 1.02.00+dfsg-2.