An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 18, 2019 |
| Debian | — | Upgrade vlc | Jun 20, 2019 | Jun 18, 2019 |
| Freebsd | — | Upgrade vlc | Jun 21, 2019 | Jun 20, 2019 |
| Gentoo Linux | — | Upgrade media-video/vlc. | Aug 19, 2019 | Jun 18, 2019 |
| Suse | — | Upgrade vlc-noxUpgrade vlc-qtUpgrade vlc-vdpauUpgrade vlc-jackUpgrade vlc-langUpgrade aom-toolsUpgrade libvlccore9Upgrade libaom-develUpgrade vlcUpgrade libaom0Upgrade libaom-devel-docUpgrade vlc-codec-gstreamerUpgrade libvlc5Upgrade vlc-develUpgrade libaom0-64bit | Aug 9, 2019 | Jun 18, 2019 |
| Ubuntu | — | Upgrade vlc | Jul 26, 2019 | Jun 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub