VideoLAN
Vulnerability activity for VideoLAN: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 2.9LowOct 23, 2026VideoLAN VLC for Android Auth bypass / access controlCVE-2026-115724VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() that trusts content URIs based only on the com.fsck.k9.attachmentprovider or gmail-ls authority. A co-installed app without permissions can declare these authorities and send a crafted VIEW intent to the exported StartActivity, making VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory, overwriting other apps' files when VLC holds All files acces
- 5.5MediumOct 19, 2026VideoLAN libbluray Denial of serviceCVE-2026-112283VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c that trusts the num_point field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge num_point to exhaust memory and CPU, causing denial of service.
- 5.5MediumOct 19, 2026VideoLAN libbluray Memory corruptionCVE-2026-112282VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with num_ep_fine set to zero and an unclamped ref_ep_fine_id, triggering reads during seeking for denial of service.
- 5.5MediumOct 18, 2026VideoLAN libdvdnav Memory corruptionCVE-2026-112058VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Play program chain issues JumpTT with title 0 or an oversized number, reading past the heap title table and crashing the player.
- 5.5MediumOct 18, 2026VideoLAN libdvdnav Memory corruptionCVE-2026-112057libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image declaring a larger VMGI title vts_ttn than the title set's entries to crash applications enumerating chapters.
- 7.8HighSep 29, 2026Videolan vlc Path traversal / file handlingCVE-2026-102875VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code execution through Lua script injection.
- 4.3MediumSep 9, 2026VideoLAN VLC media player Memory corruptionCVE-2026-73324Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
- 7.0HighSep 9, 2026VideoLAN VLC media player Memory corruptionCVE-2026-56711VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14970A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file.1.9% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14778The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.1.5% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14777The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free.1.5% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14776A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file.1.5% likely
- 5.5MediumAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14534In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack.1.4% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14533The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free.1.5% likely
- 7.8HighAug 29, 2019Videolan vlc media playerCVE-2019-14535A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted WMV file.1.5% likely
- 7.8HighAug 29, 2019Videolan vlc media playerCVE-2019-14498A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1. As a result, an FPE can be triggered via a crafted CAF file.1.5% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14438A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.1.8% likely
- 7.8HighAug 29, 2019Videolan vlc media player Memory corruptionCVE-2019-14437The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly. As a result, a heap-based buffer over-read can be triggered via a crafted .ogg file.1.5% likely
- 9.8CriticalJun 18, 2019Videolan vlc media player Memory corruptionCVE-2019-12874An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a double free.2.4% likely
- 6.5MediumJun 13, 2019Videolan vlc media player Memory corruptionCVE-2019-5439A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.5.3% likely
Top products
- VLC media player2 CVEs in the last year
- libdvdnav2 CVEs in the last year
- libbluray2 CVEs in the last year
- VLC for Android1 CVE in the last year
- vlc1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.