{"id":"CVE-2019-8906","title":"do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.","summary":"do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cwe":["CWE-125"],"vendor":"file_project","product":"file","affected":["file = 5.35","ubuntu_linux = 16.04","ubuntu_linux = 18.04","ubuntu_linux = 18.10","leap = 15.0","leap = 42.3","iphone_os < 12.2","mac_os_x < 10.14.4","tvos < 12.2","watchos < 5.2"],"patched":["iphone_os 12.2","mac_os_x 10.14.4","tvos 12.2","watchos 5.2"],"published":"2019-02-18","updated":"2026-10-08","sourceUpdated":"2026-10-08T21:17:20.140","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2019-8906","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html","label":"cve@mitre.org"},{"url":"https://bugs.astron.com/view.php?id=64","label":"cve@mitre.org"},{"url":"https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT209599","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT209600","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT209601","label":"cve@mitre.org"},{"url":"https://support.apple.com/kb/HT209602","label":"cve@mitre.org"},{"url":"https://usn.ubuntu.com/3911-1/","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.astron.com/view.php?id=64","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT209599","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT209600","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT209601","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://support.apple.com/kb/HT209602","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://usn.ubuntu.com/3911-1/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-8906.json"},{"url":"https://access.redhat.com/security/cve/CVE-2019-8906"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679175"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8906"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-8906"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"epss":0.00497,"epssPercentile":0.424,"ingestedAt":"2026-10-08T22:11:53.696Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-08T20:59:57.146569Z"},"slug":"CVE-2019-8906","body":"## Overview\n\ndo_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.\n\n## Affected\n\n- `file = 5.35`\n- `ubuntu_linux = 16.04`\n- `ubuntu_linux = 18.04`\n- `ubuntu_linux = 18.10`\n- `leap = 15.0`\n- `leap = 42.3`\n- `iphone_os < 12.2`\n- `mac_os_x < 10.14.4`\n- `tvos < 12.2`\n- `watchos < 5.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `iphone_os 12.2`\n- `mac_os_x 10.14.4`\n- `tvos 12.2`\n- `watchos 5.2`\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 8 · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-8906.json)","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}