CVE-2019-19721: An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3....

Security readout for executives and security teams

CVE-2019-19721 is a memory-corruption denial-of-service flaw in VLC media player before 3.0.9, triggered by a crafted image file. The main business impact is application crash or workflow disruption when untrusted media is processed. The supplied sources do not show active exploitation, data theft, or confirmed remote code execution. Exposure is most likely on endpoints or media-processing workflows running VLC before 3.0.9 that open untrusted image files. SDL_Image linkage is uncertain from the CVE note, so teams should verify whether they depend on the referenced VLC or SDL_Image code paths. Treat this as a patching and exposure-reduction issue, not an emergency breach indicator. Prioritize systems that handle untrusted media at scale or support business-critical workflows, because denial-of-service impact is the clearly documented risk. Mitigation focus: Upgrade VLC media player to 3.0.9 or later where applicable.; Review VideoLAN security guidance for vendor-confirmed fixes and affected builds.; Check whether SDL_Image dependencies include the referenced vulnerable code path..

Prepared

Jun 5, 2026, 14:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.