CVE-2024-46461

2024-09-2515:15:14

CWE-122

mitre

web.nvd.nist.gov

vlc media player

denial of service

integer overflow

mms stream

arbitrary code execution

heap based overflow

cve-2024-46461

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

9.6%

JSON

VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third party could trigger either a crash of VLC or an arbitrary code execution with the target user’s privileges.