TI-2019-15984 Aliases CVE-2019-1010127 GHSA-rw6f-42g4-c764

Use after free in vcftools

LOW 37CWE-416Published 2019-07-25 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

VCFTools vcftools prior to version 0.1.15 is affected by: Use-after-free. The impact is: Denial of Service or possibly other impact (eg. code execution or information disclosure). The component is: The header::add_FILTER_descriptor method in header.cpp. The attack vector is: The victim must open a specially crafted VCF file.

Why it matters now

EPSS 0.01649 76th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed vcftools (VCFTools): 0.1.15

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VCFTools	vcftools	before 0.1.15	0.1.15	Patch available	CNA

vcftools VendorVCFTools Affected before 0.1.15 Fixed in 0.1.15 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vcftools_project:vcftools::::::::	before 0.1.15	Vulnerable	Vcftools Project

cpe:2.3:a:vcftools_project:vcftools:*:*:*:*:*:*:*:* Versions before 0.1.15 Vulnerable ·Vcftools Project

Remediation

Fix · CNA vcftools (VCFTools) Fixed in 0.1.15

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2019-1010127
2026-10-03 Alias added: GHSA-rw6f-42g4-c764

References

Exploit 1

https://docs.google.com/document/d/e/2PACX-1vQJveVcGMp_NMdBY5Je2K2k63RoCYznvKjJk5u1wJRmLotvwQkG5qiqZjpABcOkjzj49wkwGweiFwrc/pub

Other 1

https://github.com/vcftools/vcftools/issues/141

TI-2018-07899 The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote… CVSS 3.0HIGH 7.8
TI-2018-07898 The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote… CVSS 3.0HIGH 7.8
TI-2018-07883 The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences