dobidnote in readelf.c in libmagic.a in file 5.35 has a stack-based buffer over-read, related to fileprintf and filevprintf.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-8904.json"