CVE-2019-12874

CVE-2019-12874 affects VLC media player 3.x up to 3.0.7. The Matroska demuxer’s MKV parser has a double free in zlib_decompress_extra, with related MKV processing flaws that can, per advisory texts, lead to a crash or possibly arbitrary code execution. Some sources also describe related DoS risk....

CVE-2019-13602

CVE-2019-13602 affects VideoLAN VLC media player up to version 3.0.7.1. The vulnerability is an integer underflow in the function MP4_EIA608_Convert() (modules/demux/mp4/mp4.c) that can allow a remote attacker to cause a DoS via heap-based buffer overflow and crash or other unspecified impact thr...

CVE-2020-13428

CVE-2020-13428 concerns a heap-based buffer overflow in VLC media player before 3.0.11 for macOS/iOS, specifically in the function hxxx_AnnexB_to_xVC in modules/packetizer/hxxx_nal.c. The vulnerability allows remote attackers to cause a denial of service (application crash) or execute arbitrary c...

CVE-2019-13962

CVE-2019-13962 affects VLC

CVE-2018-19857

CVE-2018-19857 affects VideoLAN VLC media player 3.0.4 where the CAF demuxer in modules/demux/caf.c may read memory from an uninitialized pointer while processing CAF magic cookies due to a ReadKukiChunk() cast converting a negative value to unsigned int. This can cause denial of service and/or a...

CVE-2019-13615

CVE-2019-13615 affects VideoLAN VLC Media Player through libebml < 1.3.6 in the MKV demux module (used by VLC binaries

CVE-2020-26664

CVE-2020-26664 affects VideoLAN VLC media player, due to a heap-based buffer overflow in EbmlTypeDispatcher::send triggered by crafted MKV files. Affected version in the initial doc is VLC 3.0.11; multiple connected advisories indicate fixes in later VLC releases (e.g., 3.0.12 and newer, with dis...

CVE-2022-41325

The CVE-2022-41325 entry concerns a vulnerability in VideoLAN VLC Media Player’s VNC module up to version 3.0.17.4, caused by an integer overflow that can be triggered by opening a crafted playlist or connecting to a rogue VNC server. Impact stated: crash or potential code execution under certain...

CVE-2023-47359

CVE-2023-47359 affects VLC media player prior to 3.0.20. An incorrect offset read in GetPacket can cause a heap-based buffer overflow and memory corruption. Public advisories (including OpenVAS/Nessus listings and Ubuntu USN) flag potential crash and, in some sources, remote code execution possib...

CVE-2019-14437

CVE-2019-14437 affects VideoLAN VLC media player 3.0.7.1 and earlier: the xiph_SplitHeaders function in modules/demux/xiph.h does not check array bounds, enabling a heap-based buffer over-read via a crafted .ogg file. Public advisories note the issue among multiple VLC vulnerabilities and recomme...

CVE-2012-5470

CVE-2012-5470 affects VLC Media Player via its libpng_plugin. A crafted PNG file can trigger a denial of service (application crash) in VLC before version 2.0.4 due to an input-validation issue in the PNG handling code. Reported by multiple sources, the vulnerability base score is 4.3 (MEDIUM) wi...

CVE-2019-14438

CVE-2019-14438 affects VideoLAN VLC media player 3.0.7.1 and earlier, due to a heap-based buffer over-read in xiph_PackHeaders() within modules/demux/xiph.h, exploitable via crafted .ogg files. Multiple connected advisories confirm the issue and track fixes to VLC 3.0.8 (and related package updat...

CVE-2019-5439

VLC media player is affected by CVE-2019-5439 and related CVEs (e.g., CVE-2019-12874, CVE-2019-13602, CVE-2019-13962, CVE-2019-5459, CVE-2019-5460). The initial entry notes a buffer overflow in VLC

CVE-2019-19721

VLC media player

CVE-2019-14970

CVE-2019-14970 affects VLC media player (3.0.7.1 and earlier). The vulnerability is in the MKV demuxer code path, specifically mkv::event_thread_t, allowing a crafted .mkv file to trigger a heap-based buffer overflow. Public disclosures across multiple advisories confirm VLC 3.0.8 fixes this and ...

CVE-2019-5459

VLC Media Player (versions

CVE-2019-14778

CVE-2019-14778 affects VideoLAN VLC media player 3.0.7.1, where the mkv::virtual_segment_c::seek method in demux/mkv/virtual_segment.cpp has a use-after-free. Connected sources confirm this vulnerability in VLC’s MKV demuxer and note that remediation from multiple advisories is to upgrade VLC to ...

CVE-2019-14777

The CVE-2019-14777 entry affects VideoLAN VLC media player (3.0.7.1) with a use-after-free in the MKV demuxer (demux/mkv/mkv.cpp). Public documentation in connected sources confirms this vulnerability in VLC’s MKV demuxer and notes downstream advisories recommending upgrade; no exploit details ar...

CVE-2019-14533

CVE-2019-14533 affects VideoLAN VLC media player 3.0.7.1, where the control function of demux/asf/asf.c has a use-after-free vulnerability. Public sources in the connected documents confirm this specific ASF demuxer use-after-free (notable in the 3.0.7.1 release) and document that the issue has b...

CVE-2013-3565

CVE-2013-3565 affects VideoLAN VLC Media Player through its HTTP Interface, with multiple XSS vulnerabilities in the web UI. Versions prior to 2.0.7 are affected. An attacker can craft requests to the HTTP endpoints (requests/vlm_cmd.xml, requests/browse.xml) or include a URI in a request, which ...

CVE-2019-14534

In VLC media player, CVE-2019-14534 is a NULL pointer dereference in the ASF demuxer (SeekPercent in demux/asf/asf.c) that can lead to a denial of service. Affected product: VLC up to version 3.0.7.1. Root cause: NULL pointer dereference in ASF demuxer code when seeking percent. Impact: DoS with ...

CVE-2019-14498

CVE-2019-14498 affects VLC media player 3.0.7.1 and earlier, with a divide-by-zero vulnerability in the demux/caf.c Control function that can trigger a fault via crafted CAF files. The issue resides in the CAF demuxer code path and is associated with a numeric/division-by-zero condition. Multiple...

CVE-2019-14535

Summary: CVE-2019-14535 is a divide-by-zero error in the SeekIndex function (demux/asf/asf.c) of VLC media player 3.0.7.1 that can trigger a fault from crafted WMV files. The issue is in the ASF demuxer and was addressed in VLC upgrades to 3.0.8 across multiple advisories. Affected product: VLC m...

CVE-2019-14776

CVE-2019-14776 is a heap-based buffer over-read in DemuxInit() of demux/asf/asf.c in VideoLAN VLC media player

CVE-2019-5460

CVE-2019-5460 is a VLC double-free vulnerability reported for

CVE-2012-1775

VLC Media Player contains a stack-based buffer overflow in the MMS plugin that can be triggered by a crafted MMS URI, leading to remote code execution. The CVE-2012-1775 description specifies the issue exists in VLC prior to version 2.0.1, caused by insufficient bounds checking when copying a hos...

CVE-2011-0531

VLC MKV demuxer memory corruption (CVE-2011-0531) affects VideoLAN VLC up to 1.1.6.1 and earlier MKV/WebM demuxer; root cause is memory corruption from class mismatching in MKV demux code (MKV_IS_ID macro), enabling remote code execution and crash via crafted MKV. An exploit (Metasploit module) e...

CVE-2014-9626

VLC media player before 2.1.6 is affected by CVE-2014-9626 due to an Integer underflow in the MP4_ReadBox_String function within the MP4 demuxer (libmp4.c). An insufficient check on the box length (box size

CVE-2018-11529

VLC media player 2.2.x is affected by a use-after-free vulnerability in the MP4 demuxer that can be triggered by crafted MKV files, enabling arbitrary code execution. In the documented exploitchain, VLC 2.2.8 (and earlier 2.2.x) is at risk, with failures potentially causing denial of service. The...

CVE-2014-9629

CVE-2014-9629 refers to an Integer overflow in the Encode function in modules/codec/schroedinger.c of VideoLAN VLC before 2.1.6 and 2.2.x before 2.2.1. The flaw allows remote attackers to perform buffer overflows and execute arbitrary code via a crafted length value. Connected advisories confirm ...

CVE-2017-10699

CVE-2017-10699 affects VLC media player (v2.2.x) where avcodec 2.2.x can perform an out-of-bounds heap memory write by calling memcpy() with an incorrect size in VLC before 2.2.7, potentially crashing the application or enabling code execution. Public advisories and vendor patches indicate fixes ...

CVE-2023-47360

CVE-2023-47360 affects VLC media player prior to 3.0.20. The vulnerability is an Integer underflow that leads to an incorrect packet length. Multiple advisories (Ubuntu USN-6783-1, Nessus plugins for VLC

CVE-2014-3441

CVE-2014-3441 affects VideoLAN VLC Media Player 2.1.3. The vulnerability exists in codec/libpng_plugin.dll where a crafted .png embedded in a wave file can be used by a remote attacker to cause VLC to crash (DoS). Affected product/version: VLC 2.1.3 and earlier. Root cause: memory handling in the...

CVE-2017-17670

CVE-2017-17670 affects VideoLAN VLC media player up to version 2.2.8, where the MP4 demuxer (modules/demux/mp4/libmp4.c) contains a type-conversion bug that may change a box’s type between a read and a free operation, causing an invalid free. Multiple connected sources confirm VLC 2.x are vulnera...

CVE-2011-1931

CVE-2011-1931 is a vulnerability in FFmpeg’s AMV handling where sp5xdec.c in the Sunplus SP5X JPEG decoder (libavcodec/FFmpeg) writes outside the bounds of an unspecified array, enabling memory corruption and potentially remote code execution when processing malformed AMV files. The flaw affects ...

CVE-2021-25804

CVE-2021-25804 is a NULL-pointer dereference in Open of avi.c in VideoLAN VLC Media Player 3.0.11, leading to a DoS. Public fixes exist: Debian DLA-2728-1 applies VLC 3.0.11-0+deb9u2; Ubuntu USN-6180-1 references the same CVEs; OpenVAS and CNVD/NVD entries corroborate the advisory. The Debian/Ubu...

CVE-2019-18278

CVE-2019-18278 concerns VideoLAN VLC media player 3.0.8 on Windows when using libqt, where data from a faulting address can control code flow at libqt_plugin!vlc_entry_license__3_0_0f+0x... The core description in both the NVD entry and Red Hat advisory is consistent: the vulnerability relates to...

CVE-2015-5949

CVE-2015-5949 affects VLC media player 2.2.1, where the 3GP file parser could dereference an arbitrary pointer, allowing remote attackers to cause a denial of service (crash) and potentially execute arbitrary code. The vulnerability stems from insufficient restriction of a writable buffer in the ...

CVE-2017-8311

VLC 2.2.x contains a heap-based buffer overflow in the JacoSUB/ParseJSS subtitle parsing path from crafted subtitle files, due to skipping the NULL terminator. This can crash the player or allow arbitrary code execution. Public advisories summarize CVE-2017-8311 alongside related issues (CVE-2017...

CVE-2014-9627

The CVE-2014-9627 issue affects VLC’s MP4 demuxer (modules/demux/mp4/libmp4.c): the MP4_ReadBox_String path casts a 64‑bit box length to 32‑bit, enabling a large box size that can lead to denial of service or potentially other impact. Affected product/version: VideoLAN VLC media player prior to 2...

CVE-2018-11516

CVE-2018-11516 affects VideoLAN VLC media player 3.0.1, where the vlc_demux_chained_Delete function in input/demux_chained.c can be triggered by a crafted .swf file to cause a denial of service via heap corruption and application crash. Some sources also describe a potential for remote code execu...

CVE-2013-3564

The CVE-2013-3564 issue affects VideoLAN VLC media player’s web interface prior to version 2.0.7, where there is no access control. This allows remote attackers to view directory listings via the dir command or execute other commands without authenticating. The root cause is unauthenticated acces...

CVE-2014-9625

CVE-2014-9625 affects VideoLAN VLC media player up to version 2.1.5 (vulnerable before 2.1.6). The root cause is an incorrect cast from a 64-bit integer to a 32-bit integer in the GetUpdateFile function of misc/update.c within the Updater, enabling a crafted update status file to cause a buffer o...

CVE-2008-2430

CVE-2008-2430 affects VLC Media Player 0.8.6h on Windows via an integer overflow in the Open() function of modules/demux/wav.c when parsing a WAV fmt chunk that is too large. This vulnerability could allow remote code execution by luring a user to open a specially crafted WAV file. Related adviso...

CVE-2014-9628

CVE-2014-9628 affects VideoLAN VLC media player up to version 2.1.6, where the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c can trigger an unintended zero-size malloc during parsing of box with length 7, enabling a buffer overflow and potential arbitrary code execution. Public docs i...

CVE-2017-8312

CVE-2017-8312 affects VideoLAN VLC (2.2.x) due to a heap out-of-bounds read in ParseJSS caused by a missing string-length check in subtitle parsing. A crafted subtitles file can read heap-uninitialized data, with potential crash or code execution. Public advisories (Arch Linux ASA-201706-1, Debia...

CVE-2007-3316

VLC media player (before version 0.8.6c) is affected by multiple format-string vulnerabilities in plugins for Ogg Vorbis, Ogg Theora, CDDA, and SAP. The underlying issue is a C-style format string error in parsing the media data stream, which could allow a remote attacker to crash the player or e...

CVE-2021-25802

VLC Media Player 3.0.11 is affected by CVE-2021-25802 due to a buffer overflow in the AVI_ExtractSubtitle component, which could cause an out-of-bounds read when processing crafted .avi files. The Debian DLA-2728 advisory indicates this affects VLC on Debian 9 and fixes are available in version 3...

CVE-2016-5108

CVE-2016-5108 affects VideoLAN VLC media player prior to 2.2.4. A buffer overflow in DecodeAdpcmImaQT (modules/codec/adpcm.c) can be triggered by a crafted QuickTime IMA file, leading to denial of service (crash) and, potentially, arbitrary code execution. Exploitation is possible remotely and do...

CVE-2017-9300

VLC VLC media player before 2.2.7 is affected by CVE-2017-9300 due to a heap corruption in the libflac_plugin.dll when processing crafted FLAC files, enabling denial of service and potentially arbitrary code execution. Public advisories (Debian, Arch, openSUSE) note upgrade to VLC 2.2.7 or newer ...