CVE-2019-19721

An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-25)

CWEs

CWE-193, CWE-787

Published

2020-05-15

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• videolan:vlc_media_player

References

• http://hg.libsdl.org/SDL_image/
• https://bugs.gentoo.org/721940
• https://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=72afe7ebd8305bf4f5360293b8621cde52ec506b
• https://www.videolan.org/security/
• http://hg.libsdl.org/SDL_image/

Check your stackJSON