Skip to content

CVE-2019-13147

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in...

6.5 MediumFix available

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.91%Up 1.4 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: CVE-2019-13147
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-476
Updated: 2026-11-02

CVE List No score

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: CVE-2019-13147
Updated: 2026-11-02

EUVDEUVD-2019-4678 No score

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: EUVD-2019-4678
Updated: 2026-11-02

GitHub AdvisoriesGHSA-f72j-hf57-7h84 6.5

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in...

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: GHSA-f72j-hf57-7h84
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVAZL-43801 6.5

CVE-2019-13147 affecting package audiofile 0.3.6-27

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: AZL-43801
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVAZL-44760 6.5

CVE-2019-13147 affecting package audiofile 0.3.6-27

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: AZL-44760
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-05

Show 14 moreShow less

OSV 6.5

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: CVE-2019-13147
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2019-13147 6.5

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: DEBIAN-CVE-2019-13147
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-1782 7.5

audiofile security update

The Audio File Library is a C-based library for reading and writing audio files in many common formats.

Security Fix(es):

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.(CVE-2019-13147)

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.(CVE-2025-50950)

Record: OESA-2026-1782
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-1783 7.5

audiofile security update

The Audio File Library is a C-based library for reading and writing audio files in many common formats.

Security Fix(es):

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.(CVE-2019-13147)

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.(CVE-2025-50950)

Record: OESA-2026-1783
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-1784 7.5

audiofile security update

The Audio File Library is a C-based library for reading and writing audio files in many common formats.

Security Fix(es):

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.(CVE-2019-13147)

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.(CVE-2025-50950)

Record: OESA-2026-1784
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-1785 7.5

audiofile security update

The Audio File Library is a C-based library for reading and writing audio files in many common formats.

Security Fix(es):

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.(CVE-2019-13147)

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.(CVE-2025-50950)

Record: OESA-2026-1785
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-1786 7.5

audiofile security update

The Audio File Library is a C-based library for reading and writing audio files in many common formats.

Security Fix(es):

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.(CVE-2019-13147)

Audiofile v0.3.7 was discovered to contain a NULL pointer dereference via the ModuleState::setup function.(CVE-2025-50950)

Record: OESA-2026-1786
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2019-13147 6.5

In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file.

Record: UBUNTU-CVE-2019-13147
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2023-0347 No score

Updated audiofile packages fix a security vulnerability

2 patches are added to audiofile source to correct a vulnerability. In Audio File Library (aka audiofile) 0.3.6, there exists one NULL pointer dereference bug in ulaw2linear_buf in G711.cpp in libmodules.a that allows an attacker to cause a denial of service via a crafted file. (CVE-2019-13147)

Record: MGASA-2023-0347
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15150-1 No score

audiofile-0.3.6-16.1 on GA media

These are all security issues fixed in the audiofile-0.3.6-16.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15150-1
Updated: 2026-11-02

OSVSUSE-SU-2025:01559-1 No score

Security update for audiofile

This update for audiofile fixes the following issues:

CVE-2019-13147: Fixed NULL pointer dereference in ulaw2linear_buf that could lead to DOS (bsc#1140031).
CVE-2022-24599: unverified user input when processing audio files can lead to information leak (bsc#1196487).

Record: SUSE-SU-2025:01559-1
Updated: 2026-11-02

OSVSUSE-SU-2025:02283-1 No score

Security update for audiofile

This update for audiofile fixes the following issues:

CVE-2019-13147: Do not allow too many channel to prevent NULL pointer dereference (bsc#1140031).
CVE-2022-24599: Clear buffer when allocating (bsc#1196487).

Record: SUSE-SU-2025:02283-1
Updated: 2026-11-02

OSVSUSE-SU-2025:1559-1 No score

Security update for audiofile

This update for audiofile fixes the following issues:

CVE-2019-13147: Fixed NULL pointer dereference in ulaw2linear_buf that could lead to DOS (bsc#1140031).
CVE-2022-24599: unverified user input when processing audio files can lead to information leak (bsc#1196487).

Record: SUSE-SU-2025:1559-1
Updated: 2026-11-02

OSVUSN-6558-1 No score

audiofile vulnerabilities

It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-13440)

It was discovered that audiofile could be made to write out of bounds. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-17095)

It was discovered that audiofile could be made to dereference invalid memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service. (CVE-2019-13147)

It was discovered that audiofile could be made to leak memory. If a user or an automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to obtain sensitive information. (CVE-2022-24599)

Record: USN-6558-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`audiofile` Azure Linux:2	through 0.3.6-27	None known
`audiofile` Azure Linux:3	through 0.3.6-27	None known
`audiofile` Debian:12	before 0.3.6-5+deb12u1, plus listed versions 0.3.6-5	0.3.6-5+deb12u1
`audiofile` Debian:13	before 0.3.6-6	0.3.6-6
`audiofile` Debian:14	before 0.3.6-6	0.3.6-6
`audiofile` Debian:10 From an advisory covering 2 CVEs	before 0.3.6-5+deb10u1, plus listed versions 0.3.6-5	0.3.6-5+deb10u1
`audiofile` Debian:11 From an advisory covering 2 CVEs	before 0.3.6-5+deb11u1, plus listed versions 0.3.6-5	0.3.6-5+deb11u1
`audiofile` Mageia:9	before 0.3.6-14.mga9	0.3.6-14.mga9
`audiofile` openEuler:24.03-LTS From an advisory covering 2 CVEs	before 0.3.6-30.oe2403	0.3.6-30.oe2403
`audiofile` openEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs	before 0.3.6-30.oe2403sp1	0.3.6-30.oe2403sp1

Show 22 moreShow less

Affected packages
Package	Affected	Fixed
`audiofile` openEuler:24.03-LTS-SP2 From an advisory covering 2 CVEs	before 0.3.6-30.oe2403sp2	0.3.6-30.oe2403sp2
`audiofile` openEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs	before 0.3.6-29.oe2003sp4	0.3.6-29.oe2003sp4
`audiofile` openEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs	before 0.3.6-30.oe2203sp4	0.3.6-30.oe2203sp4
`audiofile` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 2 CVEs	before 0.3.6-150000.3.12.1	0.3.6-150000.3.12.1
`audiofile` SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 2 CVEs	before 0.3.6-11.10.1	0.3.6-11.10.1
`audiofile` SUSE:Linux Enterprise Module for Desktop Applications 15 SP6 From an advisory covering 2 CVEs	before 0.3.6-150000.3.12.1	0.3.6-150000.3.12.1
`audiofile` openSUSE:Leap 15.6 From an advisory covering 2 CVEs	before 0.3.6-150000.3.12.1	0.3.6-150000.3.12.1
`audiofile` Ubuntu:Pro:14.04:LTS	before 0.3.6-2ubuntu0.14.04.3+esm1, plus listed versions 0.3.6-20.3.6-2ubuntu0.14.04.10.3.6-2ubuntu0.14.04.20.3.6-2ubuntu0.14.04.3	0.3.6-2ubuntu0.14.04.3+esm1
`audiofile` Ubuntu:Pro:16.04:LTS	before 0.3.6-2ubuntu0.16.04.1+esm1, plus listed versions 0.3.6-20.3.6-2ubuntu0.15.10.10.3.6-2ubuntu0.16.04.1	0.3.6-2ubuntu0.16.04.1+esm1
`audiofile` Ubuntu:Pro:18.04:LTS	before 0.3.6-4ubuntu0.1~esm1, plus listed versions 0.3.6-4	0.3.6-4ubuntu0.1~esm1
`audiofile` Ubuntu:20.04:LTS	before 0.3.6-5+deb10u1build0.20.04.1, plus listed versions 0.3.6-50.3.6-5build1	0.3.6-5+deb10u1build0.20.04.1
`audiofile` Ubuntu:22.04:LTS	before 0.3.6-5+deb10u1build0.22.04.1, plus listed versions 0.3.6-5build1	0.3.6-5+deb10u1build0.22.04.1
`audiofile` Ubuntu:24.04:LTS	All versions, plus listed versions 0.3.6-5build20.3.6-60.3.6-6build10.3.6-6build2	None known
`audiofile` Ubuntu:25.10	All versions, plus listed versions 0.3.6-7build1	None known
`audiofile` Ubuntu:26.10	All versions, plus listed versions 0.3.6-7build2	None known
`audiofile` Ubuntu:26.04:LTS	All versions, plus listed versions 0.3.6-7build10.3.6-7build2	None known
`audiofile` Ubuntu:Pro:14.04:LTS From an advisory covering 4 CVEs	before 0.3.6-2ubuntu0.14.04.3+esm1, plus listed versions 0.3.6-20.3.6-2ubuntu0.14.04.10.3.6-2ubuntu0.14.04.20.3.6-2ubuntu0.14.04.3	0.3.6-2ubuntu0.14.04.3+esm1
`audiofile` Ubuntu:Pro:16.04:LTS From an advisory covering 4 CVEs	before 0.3.6-2ubuntu0.16.04.1+esm1, plus listed versions 0.3.6-20.3.6-2ubuntu0.15.10.10.3.6-2ubuntu0.16.04.1	0.3.6-2ubuntu0.16.04.1+esm1
`audiofile` Ubuntu:Pro:18.04:LTS From an advisory covering 4 CVEs	before 0.3.6-4ubuntu0.1~esm1, plus listed versions 0.3.6-4	0.3.6-4ubuntu0.1~esm1
`audiofile` Ubuntu:20.04:LTS From an advisory covering 4 CVEs	before 0.3.6-5+deb10u1build0.20.04.1, plus listed versions 0.3.6-50.3.6-5build1	0.3.6-5+deb10u1build0.20.04.1
`audiofile` Ubuntu:22.04:LTS From an advisory covering 4 CVEs	before 0.3.6-5+deb10u1build0.22.04.1, plus listed versions 0.3.6-5build1	0.3.6-5+deb10u1build0.22.04.1
`audiofile` openSUSE:Tumbleweed	before 0.3.6-16.1	0.3.6-16.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 5, 2026	facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-13147 is a medium vulnerability (CVSS 6.5) in Audiofile, published July 1, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in audiofile 0.3.6-5+deb12u1.

References

Show 22 moreShow less