CVE-2019-14496
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer...
CVE-2019-14496 is a high vulnerability (CVSS 7.8) in Milkytracker Project Milkytracker, published August 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in milkytracker 1.02.00+dfsg-2.
- Severity
- 7.8 HighCVSS 3.1, NVD
- Exploit chance
- 1.39%EPSS, 72nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.02.00+dfsg-2milkytracker +7 more
Description
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
milkytrackerDebian:12 | before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:13 | before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:14 | before 1.02.00+dfsg-2 | 1.02.00+dfsg-2 |
milkytrackerDebian:8 From an advisory covering 3 CVEs | before 0.90.85+dfsg-2.2+deb8u1, plus listed versions 0.90.85+dfsg-2.2 | 0.90.85+dfsg-2.2+deb8u1 |
milkytrackerDebian:9 From an advisory covering 4 CVEs | before 0.90.86+dfsg-2+deb9u1, plus listed versions 0.90.86+dfsg-2 | 0.90.86+dfsg-2+deb9u1 |
milkytrackerUbuntu:16.04:LTS | before 0.90.85+dfsg-2.2+deb8u1build0.16.04.1, plus listed versions 0.90.85+dfsg-2.2 | 0.90.85+dfsg-2.2+deb8u1build0.16.04.1 |
milkytrackerUbuntu:18.04:LTS | All versions, plus listed versions 1.01.00+dfsg-11.01.00+dfsg-1build11.01.00+dfsg-21.02.00+dfsg-1 | None known |
milkytrackerUbuntu:16.04:LTS From an advisory covering 3 CVEs | before 0.90.85+dfsg-2.2+deb8u1build0.16.04.1, plus listed versions 0.90.85+dfsg-2.2 | 0.90.85+dfsg-2.2+deb8u1build0.16.04.1 |
What each source reports
NVD Score used
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
CVE-2019-14496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE ListNo score
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
CVE-2019-14496- Updated
- 2026-11-02
EUVDEUVD-2019-5672No score
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
EUVD-2019-5672- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99qg-7j2m-hhr7
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer...
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
GHSA-99qg-7j2m-hhr7- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
CVE-2019-14496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14496
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
DEBIAN-CVE-2019-14496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-14496
LoaderXM::load in LoaderXM.cpp in milkyplay in MilkyTracker 1.02.00 has a stack-based buffer overflow.
- Record
UBUNTU-CVE-2019-14496- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-4499-1No score
MilkyTracker vulnerabilities
It was discovered that MilkyTracker did not properly handle certain input. If a user were tricked into opening a malicious file, an attacker could cause MilkyTracker to crash or potentially execute arbitrary code.
- Record
USN-4499-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.