An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 18, 2019 | |
| Debian | debian-upgrade-vlc | Jun 20, 2019 | Jun 18, 2019 | |
| Freebsd | freebsd-upgrade-package-vlc | Jun 21, 2019 | Jun 20, 2019 | |
| Gentoo Linux | gentoo-linux-upgrade-media-video-vlc | Aug 19, 2019 | Jun 18, 2019 | |
| Suse | — | suse-upgrade-aom-toolssuse-upgrade-libaom-develsuse-upgrade-libaom-devel-docsuse-upgrade-libaom0suse-upgrade-libaom0-64bitsuse-upgrade-libvlc5suse-upgrade-libvlccore9suse-upgrade-vlcsuse-upgrade-vlc-codec-gstreamersuse-upgrade-vlc-develsuse-upgrade-vlc-jacksuse-upgrade-vlc-langsuse-upgrade-vlc-noxsuse-upgrade-vlc-qtsuse-upgrade-vlc-vdpau | Aug 9, 2019 | Jun 18, 2019 |
| Ubuntu | ubuntu-upgrade-vlc | Jul 26, 2019 | Jun 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub