Is CVE-2019-13962 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 4%.

What products does CVE-2019-13962 affect?

Tracked products affected include VLC media player. Check the version you run to see whether it is affected.

How do I fix CVE-2019-13962?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2019-13962

Q: What is CVE-2019-13962?

CVE-2019-13962 is a critical-severity software vulnerability (Out-of-bounds read) with a CVSS score of 9.8. lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

CRITICAL severity · CVSS 9.8 · Out-of-bounds read

9.8CVSS CRITICAL

Summary

lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)4%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

VLC media player

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://git.videolan.org/?p=vlc/vlc-3.0.git%3Ba=commit%3Bh=2b4f9d0b0e0861f262c90e9b9b94e7d53b864509
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00005.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00037.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00040.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00081.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00036.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00046.htmlAdvisory
http://www.securityfocus.com/bid/109306