Videolan Vlc Media Player vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Videolan Vlc Media Player: 10 record(s), with affected versions and fixes.cpe:2.3:a:videolan:vlc_media_player
CVE-2026-73324
Medium · 4.3
CWE-125 Sep 9, 2026
VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability
Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration.
CVE-2026-56711
High · 7.0
CWE-190 Sep 9, 2026
VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability
VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code execution with the privileges of the VLC process.
CVE-2025-51602
Medium · 4.8
CWE-125 Jan 16, 2026
Out-of-bounds Read in Videolan Vlc Media Player
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
CVE-2020-26664
High · 7.8
CWE-787 Jan 8, 2021
Out-of-bounds Write in Videolan Vlc Media Player
A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file.
CVE-2019-19721
High · 7.8
CWE-193 May 15, 2020
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC…
An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE: this may be related to the SDL_Image product.
CVE-2019-5460
Medium · 5.5
CWE-415 Jul 30, 2019
Double Free in Videolan Vlc Media Player
Double Free in VLC versions <= 3.0.6 leads to a crash.
CVE-2019-5459
High · 7.1
CWE-191 Jul 30, 2019
Integer Underflow in Videolan Vlc Media Player
An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read.
CVE-2019-13962
Critical · 9.8
CWE-125 Jul 18, 2019
Out-of-bounds Read in Videolan Vlc Media Player
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-13602
High · 7.8
CWE-191 Jul 14, 2019
Integer Underflow in Videolan Vlc Media Player
An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service (heap-based buffer overflow and crash) or possibly have unspecified other impact via a crafted .mp4 file.
CVE-2018-19857
Critical · 9.1
CWE-824 Dec 5, 2018
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an...
The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a ReadKukiChunk() cast converts a return value to an unsigned int even if that value is negative. This could result in a denial of service and/or a potential infoleak.