CVE-2019-14004

Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…

published January 21, 2020

CVSS
—
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

⚠️ A rogue MKV clip could lead to an unexpected buffer overflow in your Snapdragon devices! 🎬 Think of it as a restaurant where the chef tries to prepare a dish with a recipe that has incorrect measurements—too much of the wrong ingredient spills over, causing a culinary disaster! 🍽️ An attacker could exploit this flaw to crash the device or potentially run arbitrary code. While this may sound more inconvenient than catastrophic, it could lead to some seriously frustrating downtime or worse, loss of sensitive data.

Put simply

Think of it as a restaurant where the chef tries to prepare a dish with a recipe that has incorrect measurements—too much of the wrong ingredient spills over, causing a culinary disaster! 🍽️ This vulnerability arises when the system processes an MKV file with an invalid EBML size, leading to a buffer overflow that can disrupt normal operations. Devices exposed to malformed MKV files are at risk.

What to do

An attacker could exploit this flaw to crash the device or potentially run arbitrary code. While this may sound more inconvenient than catastrophic, it could lead to some seriously frustrating downtime or worse, loss of sensitive data. To mitigate this risk, update the affected Snapdragon firmware to the latest version as soon as it's available. Additionally, ensure that your devices have strict controls on the types of media files they can process. You've got this! With timely updates, your devices will be rock-solid and secure. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00902 · 59.3th percentile
Published
2020-01-21T06:30Z
EPSS history
Timeline
  • 21 JAN 06:30Z
    Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity…
    cvelistv5