CRITICAL 9.8 Microsoft

CVE-2019-14192

An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call.

Microsoft Security Update 2019-Jul: An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet integer underflow during an nc_input_packet call.

Affected Products

cbl2 qemu 6.2.0-24 on CBL Mariner 2.0
azl3 qemu 8.2.0-16 on Azure Linux 3.0
cbl2 qemu 6.2.0-24 on CBL-Mariner 2.0

References

Published: 2019-07-09 · Source: Microsoft · Feed updated: 2026-10-23

This critical severity vulnerability with a CVSS score of 9.8 was published on 2019-07-09 via Microsoft. Affected: cbl2 qemu 6.2.0-24 on CBL Mariner 2.0, azl3 qemu 8.2.0-16 on Azure Linux 3.0, cbl2 qemu 6.2.0-24 on CBL-Mariner 2.0.

Risk Timeline

CVE Disclosed2019-07-09 · 2662 days ago

Remediation Resources

Official Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2019-14192

NVD / MITRE

nvd.nist.gov/vuln/detail/CVE-2019-14192

Related Vulnerabilities

CVE	Title	Severity	CVSS
CVE-2017-20230	Storable versions before 3.05 for Perl has a stack overflow	CRITICAL	10.0
CVE-2022-49043	xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free.	CRITICAL	10.0
CVE-2024-41110 PoC	Moby authz zero length regression	CRITICAL	9.9
CVE-2025-49844 PoC	Redis Lua Use-After-Free may lead to remote code execution	CRITICAL	9.9
CVE-2026-3381	Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure ver	CRITICAL	9.8
CVE-2026-4176	Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from	CRITICAL	9.8

vulnfeed aggregates 10643 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.