TI-2019-14443 Aliases CVE-2019-20016 GHSA-7m36-g6v3-rhwr

libmysofa before 2019-11-24 does not properly restrict recursive function calls, as…

LOW 33CWE-787Published 2019-12-27 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

libmysofa before 2019-11-24 does not properly restrict recursive function calls, as demonstrated by reports of stack consumption in readOHDRHeaderMessageDatatype in dataobject.c and directblockRead in fractalhead.c. NOTE: a download of v0.9 after 2019-12-06 should fully remediate this issue.

Why it matters now

EPSS 0.01953 80th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:symonics:libmysofa::::::::	before 0.9	Vulnerable	Symonics

cpe:2.3:a:symonics:libmysofa:*:*:*:*:*:*:*:* Versions before 0.9 Vulnerable ·Symonics

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2019-20016
2026-10-03 Alias added: GHSA-7m36-g6v3-rhwr

References

Exploit 2

Patch 1

https://github.com/hoene/libmysofa/commit/2e6fac6ab6156dae8e8c6f417741388084b70d6f

TI-2019-07967 treeRead in hdf/btree.c in libmysofa before 0.7 does not properly validate multiplications and additions. CVSS 3.0CRITICAL 9.8
TI-2019-12086 Symonics libmysofa 0.7 has an invalid write in readOHDRHeaderMessageDataLayout in hdf/dataobject.c. CVSS 3.1CRITICAL 9.8
TI-2019-12085 Symonics libmysofa 0.7 has a NULL pointer dereference in getHrtf in hrtf/reader.c. CVSS 3.1CRITICAL 9.8
TI-2021-02688 Heap-based Buffer Overflow in hoene/libmysofa CVSS 3.1CRITICAL 9.8
TI-2020-18473 Buffer overflow in readDataVar in hdf/dataobject.c in Symonics libmysofa 0.5 - 1.1 allows… CVSS 3.1HIGH 8.8
TI-2020-05565 libmysofa 0.9.1 has a stack-based buffer overflow in readDataVar in hdf/dataobject.c… CVSS 3.1HIGH 8.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences