Medium severity6.5OSV Advisory· Published Nov 9, 2018· Updated Jun 17, 2026

CVE-2018-19130

Description

In Libav 12.3, there is an invalid memory access in vc1_decode_frame in libavcodec/vc1dec.c that allows attackers to cause a denial-of-service via a crafted aac file. NOTE: This may be a duplicate of CVE-2017-17127

Affected products

Libav/LibavOSV3 versions
dev14.2, v0.7, v0.7b1, …+ 2 more
- (no CPE)range: dev14.2, v0.7, v0.7b1, …
- cpe:2.3:a:libav:libav:12.3:*:*:*:*:*:*:*
- (no CPE)range: <12.3

Patches

Vulnerability mechanics

References

bugzilla.libav.org/show_bug.cginvdExploitIssue TrackingThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/152819nvdThird Party Advisory
lists.debian.org/debian-lts-announce/2019/12/msg00003.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000