Videolan
Videolan VLC Media Player: vulnerabilidades y CVE
Videolan VLC Media Player tiene 118 vulnerabilidades publicadas, 4 de ellas en los últimos 12 meses. 6 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE118
Últimos 12 meses4
Críticas6
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-102875 | Alta (8.5) | 0.17% | — | 29 sept 2026 | VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal… |
| CVE-2026-73324 | Media (5.3) | 0.24% | — | 9 sept 2026 | Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction… |
| CVE-2026-56711 | Alta (7.3) | 0.12% | — | 9 sept 2026 | VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation requires user interaction and may result in application termination or code… |
| CVE-2025-51602 | Media (4.8) | 0.41% | — | 16 ene 2026 | mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server. |
| CVE-2024-46461 | Alta (8) | 0.61% | — | 25 sept 2024 | VLC media player 3.0.20 and earlier is vulnerable to denial of service through an integer overflow which could be triggered with a maliciously crafted mms stream (heap based overflow). If successful, a malicious third… |
| CVE-2023-46814 | Alta (7.8) | 0.28% | — | 22 nov 2023 | A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard… |
| CVE-2023-47360 | Alta (7.5) | 0.91% | — | 7 nov 2023 | Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. |
| CVE-2023-47359 | Crítica (9.8) | 1.1% | — | 7 nov 2023 | Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption. |
| CVE-2022-41325 | Alta (7.8) | 0.68% | — | 6 dic 2022 | An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue VNC server, to crash VLC or execute code… |
| CVE-2021-25804 | Alta (7.5) | 1.8% | — | 26 jul 2021 | A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application. |
| CVE-2021-25803 | Alta (7.1) | 0.74% | — | 26 jul 2021 | A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. |
| CVE-2021-25802 | Alta (7.1) | 0.74% | — | 26 jul 2021 | A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. |
| CVE-2021-25801 | Alta (7.1) | 1.5% | — | 26 jul 2021 | A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file. |
| CVE-2020-26664 | Alta (7.8) | 1.5% | — | 8 ene 2021 | A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file. |
| CVE-2020-13428 | Alta (7.8) | 2.4% | — | 8 jun 2020 | A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers to cause a denial of service (application… |
| CVE-2019-19721 | Alta (7.8) | 2.0% | — | 15 may 2020 | An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory corruption) via a crafted image file. NOTE:… |
| CVE-2013-3564 | Media (5.3) | 1.1% | — | 6 feb 2020 | The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating. |
| CVE-2013-3565 | Media (6.1) | 1.6% | — | 31 ene 2020 | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to… |
| CVE-2014-9630 | Alta (7.8) | 1.5% | — | 24 ene 2020 | The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by arbitrary input data, which allows remote… |
| CVE-2014-9629 | Alta (7.8) | 2.4% | — | 24 ene 2020 | Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer overflow attacks and execute arbitrary… |
| CVE-2014-9628 | Alta (7.8) | 2.2% | — | 24 ene 2020 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and conduct buffer overflow attacks, and… |
| CVE-2014-9627 | Alta (7.8) | 1.1% | — | 24 ene 2020 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to… |
| CVE-2014-9626 | Alta (7.8) | 1.5% | — | 24 ene 2020 | Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact… |
| CVE-2014-9625 | Alta (7.8) | 2.4% | — | 24 ene 2020 | The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit integer, which allows remote attackers to… |
| CVE-2019-18278 | Alta (7.8) | 0.42% | — | 23 oct 2019 | When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at libqt_plugin!vlc_entry_license__3_0_0f+0x00000000003b9aba. NOTE: the VideoLAN security… |
| CVE-2019-14970 | Alta (7.8) | 1.9% | — | 29 ago 2019 | A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file. |
| CVE-2019-14778 | Alta (7.8) | 1.5% | — | 29 ago 2019 | The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
| CVE-2019-14777 | Alta (7.8) | 1.5% | — | 29 ago 2019 | The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free. |
| CVE-2019-14776 | Alta (7.8) | 1.5% | — | 29 ago 2019 | A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file. |
| CVE-2019-14534 | Media (5.5) | 1.4% | — | 29 ago 2019 | In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.