CVE-2019-9133

MEDIUM

KMPlayer < 2018.12.24.14 - Integer Underflow via Subtitle Processing

Title source: llm

Description

When processing subtitles format media file, KMPlayer version 2018.12.24.14 or lower doesn't check object size correctly, which leads to integer underflow then to memory out-of-bound read/write. An attacker can exploit this issue by enticing an unsuspecting user to open a malicious file.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_misc

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=34991

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4D55BLGBNWNIMNI5N57WDPAFQCUIM6XX/

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VT5HBIKH64YRZFFAPXGOTHIQJHSTQJF7/

Scores

CVSS v3 5.5

EPSS 0.0171

EPSS Percentile 74.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-190 CWE-191

Status published

Products (3)

fedoraproject/fedora 29

fedoraproject/fedora 30

kmplayer/kmplayer < 2018.12.24.14

Published Apr 09, 2019

Tracked Since Feb 18, 2026