# Access Violation Reading EXPLOITABLE_0228

Malformed MKV SimpleBlock audio frame triggers a double-free/out-of-bounds write in VLC's libfaad_plugin, crashing the player and potentially enabling memory read/write.

- Payout: $1,135
- Severity: medium
- Program: VLC (European Commission - DIGIT)
- Credited: biewuxz
- Disclosed: 2019-07-24
- CVE: CVE-2019-5460
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/503208
- Library page: https://bugbountylibrary.com/r/h1%3A503208
- Tags: domain:desktop impact:dos kind:bounty platform:hackerone sev:medium tech:windows technique:fuzzing technique:reverse-engineering vuln:dos vuln:memory-corruption

**Target:** VLC media player 4.0.0-dev (Windows) MKV demuxer + libfaad AAC decoder plugin
**Root cause:** Crafted Frame data in an MKV SimpleBlock (track 2, audio) is passed to libfaad_plugin, which performs an out-of-bounds write at libfaad_plugin+0x2b9d (mov [r9+r11*4],r14d) leading to a double-free/access violation.
**Steps:**
1. Obtain normal.mkv (MD5 46D9C3E247FF3C528EBDF18C19F3458B).
2. Overwrite bytes from offset 0xfd41 to 0xfda4 with 0x00 padding to produce crash.mkv (MD5 5CF35EEF33C024BF49A039A17D85A3AA).
3. Confirm mutation lies in Segment->Cluster->Simple Block->Frame of track number 2 (audio) via MKVToolNix.
4. Open crash.mkv in VLC 4.0.0-dev on Windows 8.
5. Observe crash; attach WinDbg to see fault at libfaad_plugin+0x2b9d with `mov dword ptr [r9+r11*4],r14d` writing to invalid address.
**How found:** Fuzzing/mutation of a valid MKV: zero-padded a Frame region in an audio SimpleBlock, then diffed against the normal file and triaged the crash in WinDbg to the libfaad_plugin write instruction.
**Exploitation:** Attacker delivers a crafted MKV file to a victim; on playback VLC's AAC decoder writes out of bounds, corrupting memory. Report claims potential read/write of memory but no full weaponized exploit chain is shown.
**Insight:** Audio codec plugins (libfaad) are reachable via container-level SimpleBlock frames; mutating the Frame payload of a non-video track while keeping container structure valid is a productive fuzzing angle for media parsers.