VYPR
← All advisories
High severityNVD Advisory· Published Jun 7, 2019· Updated Aug 5, 2024

CVE-2018-19802

CVE-2018-19802

Description

aubio v0.4.0 to v0.4.8 contains a NULL pointer dereference in new_aubio_onset, triggering a crash via crafted audio input.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

aubio v0.4.0 to v0.4.8 contains a NULL pointer dereference in new_aubio_onset, triggering a crash via crafted audio input.

Vulnerability

Details

CVE-2018-19802 is a NULL pointer dereference vulnerability found in the aubio audio analysis library, affecting versions 0.4.0 through 0.4.8. The flaw resides in the new_aubio_onset function, which is responsible for initializing onset detection objects. When specially crafted audio data is processed, the function can dereference a NULL pointer, leading to an immediate crash of the application [1][2].

Exploitation

Context

The vulnerability can be triggered remotely if an attacker can supply a malicious audio file to an application using the vulnerable aubio library. No authentication is required, and the attack vector is over the network via crafted audio input. The crash occurs during the onset detection setup phase, meaning simply opening or analyzing a malicious file can cause the denial of service [1][2].

Impact

Successful exploitation results in a denial of service (application crash). There is no known code execution impact; the vulnerability is limited to causing a NULL pointer dereference, which reliably terminates the affected process [1][2].

Mitigation

The issue was fixed in aubio version 0.4.9, as documented in the changelog [4]. Users should upgrade to this version or later. The vulnerability is also tracked in the PyPA advisory database for Python packages [3]. Affected distributions, including openSUSE, have released security updates [1].

References
  1. NVD - CVE-2018-19802
  2. GitHub - aubio/aubio: a library for audio and music analysis
  3. advisory-database/vulns/aubio/PYSEC-2019-164.yaml at main · pypa/advisory-database
  4. aubio/ChangeLog at 0.4.9 · aubio/aubio

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
aubioPyPI
>= 0.4.0, < 0.4.90.4.9

Affected products

8

Patches

1
c5ee1307bdc0

[notes] prevent null pointer dereference

https://github.com/aubio/aubioPaul BrossierNov 28, 2018via ghsa
commit
1 file changed · +4 −0
  • src/notes/notes.c+4 −0 modified
    @@ -83,6 +83,7 @@ aubio_notes_t * new_aubio_notes (const char_t * method,
   o->isready = 0;
 
   o->onset = new_aubio_onset (onset_method, o->onset_buf_size, o->hop_size, o->samplerate);
+  if (o->onset == NULL) goto fail;
   if (o->onset_threshold != 0.) aubio_onset_set_threshold (o->onset, o->onset_threshold);
   o->onset_output = new_fvec (1);
 
@@ -99,6 +100,9 @@ aubio_notes_t * new_aubio_notes (const char_t * method,
   o->note_buffer = new_fvec(o->median);
   o->note_buffer2 = new_fvec(o->median);
 
+  if (!o->onset_output || !o->pitch_output ||
+      !o->note_buffer || !o->note_buffer2) goto fail;
+
   o->curnote = -1.;
   o->newnote = 0.;

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.