CVE-2018-19857: Infoleak
Last updated 26 August 2025
Other sources
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-19857?
CVE-2018-19857 is a vulnerability in the CAF demuxer in VideoLAN VLC media player 3.0.4 that may read memory from an uninitialized pointer when processing magic cookies in CAF files.
What is the severity of CVE-2018-19857?
The severity of CVE-2018-19857 is critical, with a severity value of 9.1.
Which software versions are affected by CVE-2018-19857?
The affected software versions include VLC media player 3.0.4 and Debian Linux 9.0.
How can I fix CVE-2018-19857?
To fix CVE-2018-19857, update your VLC media player to version 3.0.7.1-0ubuntu18.04.1 for Ubuntu Bionic, or version 3.0.4-4 for upstream Ubuntu, and update your Debian VLC package to one of the remedied versions: 3.0.17.4-0+deb10u1, 3.0.17.4-0+deb10u2, 3.0.18-0+deb11u1, 3.0.18-2, or 3.0.19-1.
Are there any references for CVE-2018-19857?
Yes, you can find more information about CVE-2018-19857 at the following links: - [OpenSUSE Security Announcement 2019-08](http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.html) - [OpenSUSE Security Announcement 2019-08](http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.html) - [OpenSUSE Security Announcement 2019-08](http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.html)