CVE-2019-14296: canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer...

Security readout for executives and security teams

This CVE concerns UPX 3.95 crashing, or possibly worse, when it handles a specially crafted UPX-packed file. Business impact is mainly disruption to systems that process untrusted binaries, such as malware analysis, scanning, or build workflows. The source bundle does not provide CVSS, confirmed exploitation, or a complete affected-product matrix. Exposure is most likely where UPX 3.95 or vulnerable distro packages process untrusted packed files. This includes automated unpacking, binary triage, malware analysis, file scanning, or developer tooling. General internet-facing exposure is unclear from the sources. Treat this as a targeted operational-risk issue, not a broad emergency. Prioritize environments that ingest unknown binaries, because a crafted file could crash tooling and disrupt security or development workflows. Escalate if vulnerable UPX is exposed inside automated file-processing pipelines. Mitigation focus: Inventory UPX installations and packaged UPX versions across analysis and build systems.; Prioritize systems that process untrusted or externally supplied binaries.; Apply vendor or distribution UPX updates where available..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.