What’s Vulnerable › Vulnerabilities

CVE-2019-13615

• Severity: medium (CVSS 5.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-16 · updated 2026-06-17
• Weakness: CWE-125

Description

libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.

Affected products

• VideoLAN VLC: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: VideoLAN VLC 3.0.3. Check the vendor advisory for mitigations.

References

• http://www.securityfocus.com/bid/109304
• https://github.com/Matroska-Org/libebml/commit/05beb69ba60acce09f73ed491bb76f332849c3a0
• https://github.com/Matroska-Org/libebml/commit/b66ca475be967547af9a3784e720fbbacd381be6
• https://github.com/Matroska-Org/libebml/compare/release-1.3.5...release-1.3.6
• https://trac.videolan.org/vlc/ticket/22474
• https://usn.ubuntu.com/4073-1/
• http://www.securityfocus.com/bid/109304
• https://github.com/Matroska-Org/libebml/commit/05beb69ba60acce09f73ed491bb76f332849c3a0
• https://github.com/Matroska-Org/libebml/commit/b66ca475be967547af9a3784e720fbbacd381be6
• https://github.com/Matroska-Org/libebml/compare/release-1.3.5...release-1.3.6
• https://trac.videolan.org/vlc/ticket/22474
• https://usn.ubuntu.com/4073-1/

Get alerted when CVE-2019-13615 or the next vulnerability affects your stack