CVE-2019-8906

do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

CVSS 3.1

4.4CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

EPSS

0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-25)

CWE

CWE-125

Published

2019-02-18

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• apple:iphone_os
• apple:mac_os_x
• apple:tvos
• apple:watchos
• canonical:ubuntu_linux
• file_project:file
• opensuse:leap

References

• http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html
• https://bugs.astron.com/view.php?id=64
• https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f
• https://support.apple.com/kb/HT209599

Check your stackJSON