---
id: CVE-2019-8906
title: >-
  do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read
  because memcpy is misused.
summary: >-
  do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read
  because memcpy is misused.
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-125
vendor: file_project
product: file
affected:
  - file = 5.35
  - ubuntu_linux = 16.04
  - ubuntu_linux = 18.04
  - ubuntu_linux = 18.10
  - leap = 15.0
  - leap = 42.3
  - iphone_os < 12.2
  - mac_os_x < 10.14.4
  - tvos < 12.2
  - watchos < 5.2
patched:
  - iphone_os 12.2
  - mac_os_x 10.14.4
  - tvos 12.2
  - watchos 5.2
published: '2019-02-18'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:17:20.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2019-8906'
references:
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html'
    label: cve@mitre.org
  - url: 'https://bugs.astron.com/view.php?id=64'
    label: cve@mitre.org
  - url: >-
      https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT209599'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT209600'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT209601'
    label: cve@mitre.org
  - url: 'https://support.apple.com/kb/HT209602'
    label: cve@mitre.org
  - url: 'https://usn.ubuntu.com/3911-1/'
    label: cve@mitre.org
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00027.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00053.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://bugs.astron.com/view.php?id=64'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/file/file/commit/2858eaf99f6cc5aae129bcbf1e24ad160240185f
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT209599'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT209600'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT209601'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://support.apple.com/kb/HT209602'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://usn.ubuntu.com/3911-1/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-8906.json
  - url: 'https://access.redhat.com/security/cve/CVE-2019-8906'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1679175'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2019-8906'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2019-8906'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00497
epssPercentile: 0.424
ingestedAt: '2026-10-08T22:11:53.696Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-08T20:59:57.146569Z'
---

## Overview

do_core_note in readelf.c in libmagic.a in file 5.35 has an out-of-bounds read because memcpy is misused.

## Affected

- `file = 5.35`
- `ubuntu_linux = 16.04`
- `ubuntu_linux = 18.04`
- `ubuntu_linux = 18.10`
- `leap = 15.0`
- `leap = 42.3`
- `iphone_os < 12.2`
- `mac_os_x < 10.14.4`
- `tvos < 12.2`
- `watchos < 5.2`

## Remediation

Upgrade past the affected range:

- `iphone_os 12.2`
- `mac_os_x 10.14.4`
- `tvos 12.2`
- `watchos 5.2`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 8 · updated 2026-10-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-8906.json)