CVE-2019-19648: Fedoraproject Fedora

High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days.

In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Virustotal Yara: version 3.11.0 only

Published 2019-12-09. Last modified 2026-06-17.