{"id":"CVE-2019-19721","aliases":["DEBIAN-CVE-2019-19721","DSA-4671-1","EUVD-2019-9325","GHSA-2wrf-hf7j-cx32","MGASA-2020-0203","UBUNTU-CVE-2019-19721","USN-6180-1"],"status":"published","title":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player...","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01982,"percentile":0.80856,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193","CWE-787"],"published":"2020-04-30T00:00:00Z","modified":"2026-10-24T10:30:45Z","fixes":[{"ecosystem":"Debian:12","package":"vlc","fixed_in":["3.0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vlc","fixed_in":["3.0.9.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vlc","fixed_in":["3.0.9.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","fixed_in":["2.2.2-5ubuntu0.16.04.5+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","fixed_in":["3.0.8-0ubuntu18.04.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-0+deb9u1"}]}],"versions":["2.2.6-1","2.2.6-1~deb9u1","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.6-6","2.2.7-1","2.2.7-1~deb8u1","2.2.7-1~deb9u1","2.2.8-1","2.2.8-2","3.0.0-1","3.0.0~rc1-1","3.0.0~rc1~20171206-1","3.0.0~rc1~20171210-1","3.0.0~rc1~20171210-2","3.0.0~rc2-1","3.0.0~rc2-2","3.0.0~rc4-1","3.0.0~rc4-2","3.0.0~rc4-3","3.0.0~rc5-1","3.0.0~rc6-1","3.0.0~rc7-1","3.0.0~rc7-2","3.0.0~rc8-1","3.0.1-1","3.0.1-2","3.0.1-3","3.0.2-0+deb9u1","3.0.2-1","3.0.2-1+0.riscv64.1","3.0.2-1+0.riscv64.2","3.0.3-1","3.0.3-1+0.riscv64.1","3.0.3-1+b1+0.riscv64.1","3.0.3-1-0+deb9u1","3.0.3-1-1","3.0.3-1-2","3.0.3-1-3","3.0.3-1-4","3.0.3-2","3.0.4-1","3.0.4-2","3.0.4-3","3.0.4-4","3.0.5-1","3.0.5-2","3.0.6-0+deb9u1","3.0.6-1","3.0.7-0+deb9u1","3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb9u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":8},{"source":"osv","ecosystem":"Debian:10","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-0+deb10u1"}]}],"versions":["3.0.7-1","3.0.7.1-1","3.0.7.1-2","3.0.7.1-3","3.0.8-0+deb10u1","3.0.8-1","3.0.8-2","3.0.8-3","3.0.8-4","3.0.9.2-1"],"bundled":8},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.mga7"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:7","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-1.mga7.tainted"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-5ubuntu0.16.04.5+esm2"}]}],"versions":["2.2.1-3","2.2.1-5","2.2.2-1","2.2.2-2","2.2.2-3","2.2.2-3build1","2.2.2-4","2.2.2-5","2.2.2-5ubuntu0.16.04.1","2.2.2-5ubuntu0.16.04.2","2.2.2-5ubuntu0.16.04.3","2.2.2-5ubuntu0.16.04.4","2.2.2-5ubuntu0.16.04.5+esm1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.8-0ubuntu18.04.1+esm1"}]}],"versions":["2.2.6-6","2.2.6-6build1","2.2.7-1","2.2.8-1","2.2.8-1ubuntu4","2.2.8-2","3.0.0~rc1-1ubuntu1","3.0.0~rc1-1ubuntu3","3.0.0~rc2-1ubuntu1","3.0.0~rc2-2ubuntu1","3.0.0~rc2-2ubuntu2","3.0.0~rc4-1ubuntu1","3.0.0~rc7-2ubuntu1","3.0.0~rc8-1ubuntu1","3.0.0-1ubuntu1","3.0.1-1ubuntu5","3.0.1-2ubuntu1","3.0.1-2ubuntu2","3.0.1-3","3.0.1-3build1","3.0.2-0ubuntu0.1","3.0.3-1-1ubuntu1","3.0.4-1ubuntu0.2","3.0.7.1-0ubuntu18.04.1","3.0.8-0ubuntu18.04.1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9.2-1ubuntu0.1~esm1"}]}],"versions":["3.0.8-2","3.0.8-2build1","3.0.8-3","3.0.8-3build1","3.0.8-3build2","3.0.8-3build4","3.0.8-4","3.0.9.2-1"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"vlc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.16-1ubuntu0.1~esm1"}]}],"versions":["3.0.16-1","3.0.16-1build1","3.0.16-1build2","3.0.16-1build3","3.0.16-1build4","3.0.16-1build5","3.0.16-1build7"],"bundled":7}],"products":[{"vendor":"videolan","product":"vlc_media_player"}],"references":[{"url":"https://www.videolan.org/security/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://hg.libsdl.org/SDL_image/","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://bugs.gentoo.org/721940","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","report"]},{"url":"https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19721"},{"url":"https://git.videolan.org/?p=vlc/vlc-3.0.git;a=commit;h=72afe7ebd8305bf4f5360293b8621cde52ec506b","tags":["report"]},{"url":"https://www.videolan.org/security"},{"url":"http://hg.libsdl.org/SDL_image"},{"url":"https://github.com/advisories/GHSA-2wrf-hf7j-cx32"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19721","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0203.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26467","tags":["report"]},{"url":"https://www.videolan.org/security/sb-vlc309.html","tags":["web"]},{"url":"https://www.videolan.org/developers/vlc-branch/NEWS","tags":["web"]},{"url":"https://www.debian.org/security/2020/dsa-4671","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-19721","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6180-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-13428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25801","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-25804","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-41325","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-19721","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T17:28:23Z","modified":"2026-10-08T21:13:50.379Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2019-9325","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T17:28:23Z","modified":"2026-10-08T21:13:50Z","updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-2wrf-hf7j-cx32","title":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player...","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2022-05-24T17:17:57Z","modified":"2026-10-09T00:32:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:12:59.31428Z"}],"nvd":[{"id":"CVE-2019-19721","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T18:15:13.277Z","modified":"2026-10-08T22:16:51.79Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-193","CWE-787"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-19721","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T18:15:13.277Z","modified":"2026-10-24T10:30:45.60786038Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19721","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T18:15:13.277Z","modified":"2026-10-09T09:47:33.231642224Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"UBUNTU-CVE-2019-19721","description":"An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.","status":"published","published":"2020-05-15T18:15:00Z","modified":"2026-04-22T12:15:30.384646Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4671-1","title":"vlc - security update","status":"published","published":"2020-04-30T00:00:00Z","modified":"2026-03-09T02:11:34.378586Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0203","title":"Updated vlc packages fix security vulnerabilities","description":"Multiple security issues were discovered in the microdns plugin of the\nVLC media player, which could result in denial of service or potentially\nthe execution of arbitrary code via malicious mDNS packets (CVE-2020-6071,\nCVE-2020-6072, CVE-2020-6073, CVE-2020-6077, CVE-2020-6078, CVE-2020-6079,\nCVE-2020-6080).\n\nVLC has been updated to 3.0.10 to fix theese and other issues.\n","status":"published","published":"2020-05-08T10:57:54Z","modified":"2026-04-16T04:43:03.53543783Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-6180-1","title":"vlc vulnerabilities","description":"It was discovered that VLC could be made to read out of bounds when\ndecoding image files. If a user were tricked into opening a crafted image\nfile, a remote attacker could possibly use this issue to cause VLC to\ncrash, leading to a denial of service. This issue only affected Ubuntu\n16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-19721)\n\nIt was discovered that VLC could be made to write out of bounds when\nprocessing H.264 video files. If a user were tricked into opening a\ncrafted H.264 video file, a remote attacker could possibly use this issue\nto cause VLC to crash, leading to a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS and \nUbuntu 20.04 LTS. (CVE-2020-13428)\n\nIt was discovered that VLC could be made to read out of bounds when\nprocessing AVI video files. If a user were tricked into opening a crafted\nAVI video file, a remote attacker could possibly use this issue to cause\nVLC to crash, leading to a denial of service. This issue only affected\nUbuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-25801,\nCVE-2021-25802, CVE-2021-25803, CVE-2021-25804)\n\nIt was discovered that the VNC module of VLC contained an arithmetic\noverflow. If a user were tricked into opening a crafted playlist or\nconnecting to a rouge VNC server, a remote attacker could possibly use\nthis issue to cause VLC to crash, leading to a denial of service, or\npossibly execute arbitrary code. (CVE-2022-41325)\n","status":"published","published":"2023-06-20T19:47:23Z","modified":"2026-06-25T13:32:09.557035499Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}