An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jun 18, 2019 |
| Debian | — | Upgrade vlc | Jun 20, 2019 | Jun 18, 2019 |
| Freebsd | — | Upgrade vlc | Jun 21, 2019 | Jun 20, 2019 |
| Gentoo Linux | — | Upgrade media-video/vlc. | Aug 19, 2019 | Jun 18, 2019 |
| Suse | — | Upgrade vlc-qtUpgrade vlc-vdpauUpgrade vlc-langUpgrade vlc-noxUpgrade libvlccore9Upgrade aom-toolsUpgrade vlc-jackUpgrade vlc-codec-gstreamerUpgrade libaom0Upgrade libaom0-64bitUpgrade libvlc5Upgrade libaom-devel-docUpgrade vlcUpgrade libaom-develUpgrade vlc-devel | Aug 9, 2019 | Jun 18, 2019 |
| Ubuntu | — | Upgrade vlc | Jul 26, 2019 | Jun 18, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub