CVE-2019-15296

Name: CVE-2019-15296
Creator: NVD / NIST
Published: 2019-08-21T07:15:10.83+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.32%

Last modified Jun 17, 2026

CVE-2019-15296 is a vulnerability of currently unknown severity. An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. EPSS estimates a 1.32% chance of exploitation in the next 30 days.

Description

An issue was discovered in Freeware Advanced Audio Decoder 2 (FAAD2) 2.8.8. The faad_resetbits function in libfaad/bits.c is affected by a buffer overflow vulnerability. The number of bits to be read is determined by ld->buffer_size - words*4, cast to uint32. If ld->buffer_size - words*4 is negative, a buffer overflow is later performed via getdword_n(&ld->start[words], ld->bytes_left).

Metrics

EPSS Probability

1.32%

67.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-119

Affected Software

Vendor	Product	Versions
Audiocoding	Freeware Advanced Audio Decoder 2	2.8.8
Debian	Debian Linux	8.0

References

https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00033.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Sep/28
https://security.gentoo.org/glsa/202006-17
https://www.debian.org/security/2019/dsa-4522
https://github.com/knik0/faad2/commit/942c3e0aee748ea6fe97cb2c1aa5893225316174Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/08/msg00033.htmlThird Party Advisory
https://seclists.org/bugtraq/2019/Sep/28
https://security.gentoo.org/glsa/202006-17
https://www.debian.org/security/2019/dsa-4522

Timeline

Published: Aug 21, 2019
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2019-15296?

How severe is CVE-2019-15296?

Severity scoring for CVE-2019-15296 is pending analysis. The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.

How do I fix CVE-2019-15296?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2019-15296?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST