Security readout for executives and security teams
Plain-English summary
CVE-2019-19796 is a reported heap-based buffer overflow in Yabasic 2.86.2. A crafted BASIC source file can trigger the issue when processed by the interpreter. Business urgency depends on whether Yabasic is installed and whether it handles untrusted BASIC files.
Executive priority
Treat this as targeted software exposure, not broad enterprise urgency. Prioritize if Yabasic 2.86.2 exists in developer or automation environments that handle untrusted source files.
Technical view
The CVE description identifies a heap-based buffer overflow in the myformat function in function.c in Yabasic 2.86.2. The attack vector described is a crafted BASIC source file. The provided sources do not include CVSS, CWE, patch details, or confirmed impact beyond the overflow condition.
Likely exposure
Exposure appears limited to environments running Yabasic 2.86.2, especially where users or automation open, test, or execute BASIC source files from untrusted sources.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The reported trigger is processing a crafted BASIC source file, so exploitation likely requires file delivery or access to a workflow that runs Yabasic.
Researcher notes
The public record is sparse. Key unknowns include exact impact, exploitability beyond crash, fixed version, and affected version range. Avoid assuming remote code execution or active exploitation without additional source evidence.
Mitigation direction
- Inventory systems for Yabasic and confirm whether version 2.86.2 is present.
- Avoid processing untrusted BASIC source files with affected Yabasic versions.
- Check the upstream GitHub issue and vendor guidance for fix status.
- Limit Yabasic execution to trusted workspaces where practical.
Validation and detection
- Confirm installed Yabasic versions on developer, build, and automation systems.
- Identify workflows that process BASIC source files from users, email, or repositories.
- Review the GitHub issue for maintainer comments or linked fixes.
- Track the CVE record for updates to severity, affected versions, or remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19796 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/marcIhm/yabasic/issues/37CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.