CVE-2019-17533

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap...

8.2 HighFix available

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: High

Exploit likelihood

1.69%Up 0.9 points since Apr 14, 2021

What each source reports

NVD Score used 8.2

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: CVE-2019-17533
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:P/I:N/A:P
Weakness: CWE-125, CWE-908
Updated: 2026-11-02

CVE List No score

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: CVE-2019-17533
Updated: 2026-11-02

EUVDEUVD-2019-7883 No score

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: EUVD-2019-7883
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5pj8-j8jm-vm7w 8.2

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap...

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: GHSA-5pj8-j8jm-vm7w
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSV 8.2

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: CVE-2019-17533
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-17533 8.2

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: DEBIAN-CVE-2019-17533
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2019-17533 8.2

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.

Record: UBUNTU-CVE-2019-17533
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2020-0299 No score

Updated matio packages fix security vulnerability

Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed. (CVE-2019-17533)

Record: MGASA-2020-0299
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11040-1 No score

libmatio-devel-1.5.21-1.2 on GA media

These are all security issues fixed in the libmatio-devel-1.5.21-1.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11040-1
Updated: 2026-11-02

OSVUSN-5185-1 No score

libmatio vulnerability

It was discovered that MATIO incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or obtain sensitive information.

Record: USN-5185-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmatio` Debian:12	before 1.5.17-4	1.5.17-4
`libmatio` Debian:13	before 1.5.17-4	1.5.17-4
`libmatio` Debian:14	before 1.5.17-4	1.5.17-4
`libmatio` Debian:8	before 1.5.2-3+deb8u1, plus listed versions 1.5.2-3	1.5.2-3+deb8u1
`matio` Mageia:7	before 1.5.16-1.1.mga7	1.5.16-1.1.mga7
`libmatio` Ubuntu:Pro:14.04:LTS	before 1.5.2-1ubuntu1+esm1, plus listed versions 1.5.1-11.5.2-11.5.2-1ubuntu1	1.5.2-1ubuntu1+esm1
`libmatio` Ubuntu:Pro:16.04:LTS	before 1.5.3-1ubuntu0.1~esm1, plus listed versions 1.5.2-3build21.5.3-1	1.5.3-1ubuntu0.1~esm1
`libpdl-io-matlab-perl` Ubuntu:16.04:LTS	All versions, plus listed versions 0.005-1build10.005-1build2	None known
`mldemos` Ubuntu:16.04:LTS	All versions, plus listed versions 0.5.1-3build1	None known
`libmatio` Ubuntu:Pro:18.04:LTS	before 1.5.11-1ubuntu0.1~esm1, plus listed versions 1.5.10-11.5.11-1	1.5.11-1ubuntu0.1~esm1

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`libpdl-io-matlab-perl` Ubuntu:18.04:LTS	All versions, plus listed versions 0.005-2build2	None known
`libmatio` Ubuntu:Pro:20.04:LTS	before 1.5.17-3ubuntu0.1~esm1, plus listed versions 1.5.13-31.5.17-3	1.5.17-3ubuntu0.1~esm1
`libpdl-io-matlab-perl` Ubuntu:20.04:LTS	All versions, plus listed versions 0.005-3build10.005-3build20.005-3build30.005-4	None known
`mldemos` Ubuntu:20.04:LTS	All versions, plus listed versions 0.5.1+git.1.ee5d11f-4	None known
`libpdl-io-matlab-perl` Ubuntu:22.04:LTS	All versions, plus listed versions 0.005-5build10.006-30.006-4build1	None known
`libpdl-io-matlab-perl` Ubuntu:24.04:LTS	All versions, plus listed versions 0.006-50.006-5build10.006-5build20.006-5build3	None known
`libpdl-io-matlab-perl` Ubuntu:25.10	All versions, plus listed versions 0.006-6	None known
`libpdl-io-matlab-perl` Ubuntu:26.10	All versions, plus listed versions 0.006-6build10.006-6build2	None known
`libpdl-io-matlab-perl` Ubuntu:26.04:LTS	All versions, plus listed versions 0.006-60.006-6build1	None known
`matio` openSUSE:Tumbleweed From an advisory covering 3 CVEs	before 1.5.21-1.2	1.5.21-1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-17533 is a high vulnerability (CVSS 8.2) in Matio Project Matio, published October 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in libmatio 1.5.17-4.

References

Show 9 moreShow less