CVE-2019-9746

HIGH

libwebm < 1.0.0.27 - Denial of Service via NULL Pointer Dereference in OutputCluster and OutputTracks

Title source: llm

Description

In libwebm before 2019-03-08, a NULL pointer dereference caused by the functions OutputCluster and OutputTracks in webm_info.cc will trigger an abort, which allows a DoS attack, a similar issue to CVE-2018-19212.

References (2)

Core 2

Core References

Permissions Required, Third Party Advisory x_refsource_misc

https://bugs.chromium.org/p/webm/issues/detail?id=1605

Mailing List, Patch, Third Party Advisory x_refsource_misc

https://chromium.googlesource.com/webm/libwebm/+/2427abe0bde234987ed005a3adca461e9a85dfb7

Scores

CVSS v3 7.5

EPSS 0.0164

EPSS Percentile 73.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-476

Status published

Products (1)

webmproject/libwebm < 1.0.0.27

Published Mar 13, 2019

Tracked Since Feb 18, 2026