What’s Vulnerable › Vulnerabilities

CVE-2019-17264

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-06 · updated 2026-06-17
• Weakness: CWE-125

Description

In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue

Affected products

• Liblnk Project Liblnk: before 20191006 — fixed in 20191006

How to fix

Upgrade to a fixed version: Liblnk Project Liblnk 20191006. Check the vendor advisory for mitigations.

References

• https://github.com/libyal/liblnk/compare/20181227...20191006
• https://github.com/libyal/liblnk/issues/38
• https://github.com/libyal/liblnk/compare/20181227...20191006
• https://github.com/libyal/liblnk/issues/38

Get alerted when CVE-2019-17264 or the next vulnerability affects your stack