CVE-2018-19857

The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.

CVSS 3.0

9.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS

3.9% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-25)

CWE

CWE-824

Published

2018-12-05

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• debian:debian_linux
• videolan:vlc_media_player

References

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.html
• http://www.securityfocus.com/bid/106130

Check your stackJSON