CVE-2019-13626: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days.

SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buffer over-read in Fill_IMA_ADPCM_block, caused by an integer overflow in IMA_ADPCM_decode() in audio/SDL_wave.c.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 31 only
• Libsdl Libsdl: from 2.0.0, up to and including 2.0.9
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-07-17. Last modified 2026-06-17.