CVE-2019-13615: Medium severity Videolan VLC Media Player vulnerability
Published Jul 16, 2019
·Updated
Last updated 25 August 2025
Other sources
libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement.
— MITRE
Affected Software
2 affected componentsFixes available
Videolan VLC Media Player<3.0.3
debian/libebml
1.4.2-11.4.2-1+deb11u11.4.4-1+deb12u11.4.5-11.4.5-2
Remediation
Event History
Jul 16, 2019
CVE Published
via MITRE·04:06 PM
Data Sourced
via MITRE·04:06 PM
Description
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Aug 5, 2024
Data Sourced
via Launchpad·12:08 AM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·11:03 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·11:03 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is CVE-2019-13615?
CVE-2019-13615 is a vulnerability in libebml, a library used in the MKV module of VideoLAN VLC Media Player.
2
What is the severity of CVE-2019-13615?
CVE-2019-13615 has a severity level of medium with a severity value of 5.5.
3
How does CVE-2019-13615 affect VideoLAN VLC Media Player?
CVE-2019-13615 affects VideoLAN VLC Media Player versions up to exclusive 3.0.3.
4
What is the Common Weakness Enumeration (CWE) ID for CVE-2019-13615?
The Common Weakness Enumeration (CWE) ID for CVE-2019-13615 is CWE-125.
5
How can I fix the vulnerability CVE-2019-13615?
To fix CVE-2019-13615, update VideoLAN VLC Media Player to version 3.0.3 or later.