Unscored severity · published Jan 17, 2008
CVE-2007-6681
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA,…
–
CVSS
17.3%
EPSS
No
On KEV
Description
Stack-based buffer overflow in modules/demux/subtitle.c in VideoLAN VLC 0.8.6d allows remote attackers to execute arbitrary code via a long subtitle in a (1) MicroDvd, (2) SSA, and (3) Vplayer file.
Exploitation
Is it being used?
Exploit prediction (EPSS)17.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VL
Vlc · Videolan
through 0.8.6d · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6681
aluigi.altervista.org
http://aluigi.altervista.org/adv/vlcboffs-adv.txt
mailman.videolan.org
http://mailman.videolan.org/pipermail/vlc-devel/2007-June/032672.html
mailman.videolan.org
http://mailman.videolan.org/pipermail/vlc-devel/2007-June/033394.html
osvdb.org
http://osvdb.org/42207
secunia.com
http://secunia.com/advisories/28233
secunia.com
http://secunia.com/advisories/29284
More from Vlc
9.8
CVE-2014-6440
VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service
7.8
CVE-2026-102875
VLC media player before 3.0.24 Path Traversal via skins2
–
CVE-2008-2147
Untrusted search path vulnerability in VideoLAN VLC before 0.9.0 allows local users to execute arbitrary code via a malicious library under the modules/ or plugins/ subdirectories…
–
CVE-2008-1768
Multiple integer overflows in VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via the (1) MP4 demuxer, (2) Real demuxer, and (3) Cinepak codec, which…
–
CVE-2008-1769
VLC before 0.8.6f allow remote attackers to cause a denial of service (crash) via a crafted Cinepak file that triggers an out-of-bounds array access and memory corruption