CVE-2018-19857 Null dereference in n/a

Critical 9.1 Published 5 Dec 2018 Updated 15 Oct 2026

An attacker can cause a denial of service or information leak in VLC media player by tricking a user into opening a maliciously crafted CAF file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-19857?

CVE-2018-19857 is a critical vulnerability in Debian Debian Linux, published on 5 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.

Weakness: CWE-824

Which versions are affected by CVE-2018-19857?

It affects 2 products.

Products include Debian Debian Linux, Videolan Vlc Media Player.

How do I fix CVE-2018-19857?

Apply the vendor's patch.

Is CVE-2018-19857 being exploited?

There is no known exploitation of CVE-2018-19857 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-19857, DSA-4366-1, GHSA-7g6v-cgr9-2355, UBUNTU-CVE-2018-19857.