{"id":"CVE-2019-13615","aliases":["ALPINE-CVE-2019-13615","DEBIAN-CVE-2019-13615","EUVD-2019-5050","GHSA-fmvc-w48w-5hrr","UBUNTU-CVE-2019-13615","USN-4073-1"],"status":"published","title":"VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t:...","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02492,"percentile":0.84866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2019-07-16T00:00:00Z","modified":"2026-11-03T06:31:49Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"libebml","fixed_in":["1.3.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"libebml","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libebml","fixed_in":["1.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libebml","fixed_in":["1.3.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libebml","fixed_in":["1.3.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libebml","fixed_in":["1.3.3-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libebml","fixed_in":["1.3.5-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.1-5","1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-2ubuntu0.1"}]}],"versions":["1.3.4-2","1.3.5-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-1ubuntu0.1"}]}],"versions":["1.3.1-5","1.3.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libebml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-2ubuntu0.1"}]}],"versions":["1.3.4-2","1.3.5-2"]}],"products":[{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://trac.videolan.org/vlc/ticket/22474","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"http://www.securityfocus.com/bid/109304","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/Matroska-Org/libebml/commit/05beb69ba60acce09f73ed491bb76f332849c3a0","tags":["x_refsource_MISC","x_transferred","fix"]},{"url":"https://github.com/Matroska-Org/libebml/compare/release-1.3.5...release-1.3.6","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://usn.ubuntu.com/4073-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://github.com/Matroska-Org/libebml/commit/b66ca475be967547af9a3784e720fbbacd381be6","tags":["x_refsource_MISC","x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13615"},{"url":"https://github.com/advisories/GHSA-fmvc-w48w-5hrr"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13615","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13615","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13615","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4073-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13615","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T16:06:34Z","modified":"2024-08-04T23:57:39.469Z","updated_at":"2026-11-02T14:20:24.357095Z"}],"euvd":[{"id":"EUVD-2019-5050","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T16:06:34Z","modified":"2024-08-04T23:57:39Z","updated_at":"2026-11-03T02:40:42.016311Z"}],"ghsa":[{"id":"GHSA-fmvc-w48w-5hrr","title":"VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t:...","description":"VideoLAN VLC media player 3.0.7.1 has a heap-based buffer over-read in mkv::demux_sys_t::FreeUnused() in modules/demux/mkv/demux.cpp when called from mkv::Open in modules/demux/mkv/mkv.cpp.","status":"published","published":"2022-05-24T16:50:30Z","modified":"2023-01-28T05:06:17Z","updated_at":"2026-11-02T14:44:25.398405Z"}],"nvd":[{"id":"CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T17:15:12.58Z","modified":"2026-06-17T02:17:04.9Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"ALPINE-CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T17:15:12.58Z","modified":"2026-11-03T06:31:49.562907631Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T17:15:12.58Z","modified":"2026-10-24T14:19:54.537646185Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T17:15:12.58Z","modified":"2026-09-21T07:00:29.759596831Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13615","description":"libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.","status":"published","published":"2019-07-16T00:00:00Z","modified":"2026-04-22T12:10:06.33793Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"USN-4073-1","title":"libebml vulnerability","description":"It was discovered that libEBML incorrectly handled certain media files. If\na user were tricked into opening a specially crafted media file, libEBML\ncould possibly be made to crash, resulting in a denial of service.\n","status":"published","published":"2019-07-25T11:47:15Z","modified":"2026-04-22T10:00:15.230682Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}