VI
Vendor
VideoLAN
137
CVEs
0
On KEV
6
New 30D
Products
VL9.8
vlc
videolan
11 CVEs0 on KEV1 new
LI5.5
libbluray
VideoLAN
3 CVEs0 on KEV2 new
LI5.5
libdvdnav
VideoLAN
2 CVEs0 on KEV2 new
VF4.9
VLC for Android
VideoLAN
3 CVEs0 on KEV1 new
VM9.8
VLC media player
VideoLAN
115 CVEs0 on KEV0 new
DA8.8
Dav1d
Videolan
2 CVEs0 on KEV0 new
VF6.6
Vlc For Mobile
Videolan
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-115724 New | VF VLC for Android VideoLAN | 2.9 | Oct 23 | VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider |
| CVE-2026-112283 | LI libbluray VideoLAN | 5.5 | Oct 19 | libbluray through 1.5.1 Uncontrolled Memory Allocation via _parse_extent_start_points |
| CVE-2026-112282 | LI libbluray VideoLAN | 5.5 | Oct 19 | VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point |
| CVE-2026-112058 | LI libdvdnav VideoLAN | 5.5 | Oct 18 | libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT |
| CVE-2026-112057 | LI libdvdnav VideoLAN | 5.5 | Oct 18 | libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters |
| CVE-2026-102875 | VL vlc videolan | 7.8 | Sep 29 | VLC media player before 3.0.24 Path Traversal via skins2 |
| CVE-2026-73324 | VM VLC media player VideoLAN | 4.3 | Sep 9 | VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability |
| CVE-2026-56711 | VM VLC media player VideoLAN | 7.0 | Sep 9 | VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability |
| CVE-2026-26227 | VF VLC for Android VideoLAN | 3.7 | Feb 26 | VLC for Android < 3.7.0 Remote Access OTP Authentication Bypass |
| CVE-2026-26228 | VF VLC for Android VideoLAN | 4.9 | Feb 26 | VLC for Android < 3.7.0 Remote Access Path Traversal |
| CVE-2024-1580 | DA Dav1d Videolan | 8.8 | Feb 19 | An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size |
| CVE-2023-46814 | VM Vlc Media Player Videolan | 7.8 | Nov 22 | A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows |
| CVE-2023-47360 | VM Vlc Media Player Videolan | 7.5 | Nov 7 | Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length |
| CVE-2023-47359 | VM Vlc Media Player Videolan | 9.8 | Nov 7 | Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memory corruption |
| CVE-2023-32570 | DA Dav1d Videolan | 5.9 | May 10 | VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit |
| CVE-2022-41325 | VM Vlc Media Player Videolan | 7.8 | Dec 6 | An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or connecting to a rogue… |
| CVE-2021-25804 | VM Vlc Media Player Videolan | 7.5 | Jul 26 | A NULL-pointer dereference in "Open" in avi.c of VideoLAN VLC Media Player 3.0.11 can a denial of service (DOS) in the application |
| CVE-2021-25803 | VM Vlc Media Player Videolan | 7.1 | Jul 26 | A buffer overflow vulnerability in the vlc_input_attachment_New component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi… |
| CVE-2021-25802 | VM Vlc Media Player Videolan | 7.1 | Jul 26 | A buffer overflow vulnerability in the AVI_ExtractSubtitle component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file |
| CVE-2021-25801 | VM Vlc Media Player Videolan | 7.1 | Jul 26 | A buffer overflow vulnerability in the __Parse_indx component of VideoLAN VLC Media Player 3.0.11 allows attackers to cause an out-of-bounds read via a crafted .avi file |
| CVE-2020-26664 | VM Vlc Media Player Videolan | 7.8 | Jan 8 | A vulnerability in EbmlTypeDispatcher::send in VideoLAN VLC media player 3.0.11 allows attackers to trigger a heap-based buffer overflow via a crafted .mkv file |
| CVE-2020-13428 | VM Vlc Media Player Videolan | 7.8 | Jun 8 | A heap-based buffer overflow in the hxxx_AnnexB_to_xVC function in modules/packetizer/hxxx_nal.c in VideoLAN VLC media player before 3.0.11 for macOS/iOS allows remote attackers… |
| CVE-2019-19721 | VM Vlc Media Player Videolan | 7.8 | May 15 | An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to cause a denial of service (memory… |
| CVE-2013-3564 | VM Vlc Media Player Videolan | 5.3 | Feb 6 | The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other… |
| CVE-2013-3565 | VM Vlc Media Player Videolan | 6.1 | Jan 31 | Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML… |
| CVE-2014-9630 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | The rtp_packetize_xiph_config function in modules/stream_out/rtpfmt.c in VideoLAN VLC media player before 2.1.6 uses a stack-allocation approach with a size determined by… |
| CVE-2014-9629 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | Integer overflow in the Encode function in modules/codec/schroedinger.c in VideoLAN VLC media player before 2.1.6 and 2.2.x before 2.2.1 allows remote attackers to conduct buffer… |
| CVE-2014-9628 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to trigger an unintended zero-size malloc and… |
| CVE-2014-9627 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | The MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit… |
| CVE-2014-9626 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | Integer underflow in the MP4_ReadBox_String function in modules/demux/mp4/libmp4.c in VideoLAN VLC media player before 2.1.6 allows remote attackers to cause a denial of service… |
| CVE-2014-9625 | VM Vlc Media Player Videolan | 7.8 | Jan 24 | The GetUpdateFile function in misc/update.c in the Updater in VideoLAN VLC media player before 2.1.6 performs an incorrect cast operation from a 64-bit integer to a 32-bit… |
| CVE-2015-7810 | LI Libbluray Videolan | 4.7 | Nov 22 | libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race when expanding JAR files |
| CVE-2019-18278 | VM Vlc Media Player Videolan | 7.8 | Oct 23 | When executing VideoLAN VLC media player 3.0.8 with libqt on Windows, Data from a Faulting Address controls Code Flow starting at… |
| CVE-2019-14970 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | A vulnerability in mkv::event_thread_t in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer overflow via a crafted .mkv file |
| CVE-2019-14778 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | The mkv::virtual_segment_c::seek method of demux/mkv/virtual_segment.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free |
| CVE-2019-14777 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | The Control function of demux/mkv/mkv.cpp in VideoLAN VLC media player 3.0.7.1 has a use-after-free |
| CVE-2019-14776 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file |
| CVE-2019-14534 | VM Vlc Media Player Videolan | 5.5 | Aug 29 | In VideoLAN VLC media player 3.0.7.1, there is a NULL pointer dereference at the function SeekPercent of demux/asf/asf.c that will lead to a denial of service attack |
| CVE-2019-14533 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | The Control function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 has a use-after-free |
| CVE-2019-14535 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | A divide-by-zero error exists in the SeekIndex function of demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 |
| CVE-2019-14498 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | A divide-by-zero error exists in the Control function of demux/caf.c in VideoLAN VLC media player 3.0.7.1 |
| CVE-2019-14438 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read… |
| CVE-2019-14437 | VM Vlc Media Player Videolan | 7.8 | Aug 29 | The xiph_SplitHeaders function in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 does not check array bounds properly |
| CVE-2019-5460 | VM Vlc Media Player Videolan | 5.5 | Jul 30 | Double Free in VLC versions <= 3.0.6 leads to a crash |
| CVE-2019-5459 | VM Vlc Media Player Videolan | 7.1 | Jul 30 | An Integer underflow in VLC Media Player versions < 3.0.7 leads to an out-of-band read |
| CVE-2019-13962 | VM Vlc Media Player Videolan | 9.8 | Jul 18 | lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and… |
| CVE-2019-13615 | VM Vlc Media Player Videolan | 5.5 | Jul 16 | libebml before 1.3.6, as used in the MKV module in VideoLAN VLC Media Player binaries before 3.0.3, has a heap-based buffer over-read in EbmlElement::FindNextElement |
| CVE-2019-13602 | VM Vlc Media Player Videolan | 7.8 | Jul 14 | An Integer Underflow in MP4_EIA608_Convert() in modules/demux/mp4/mp4.c in VideoLAN VLC media player through 3.0.7.1 allows remote attackers to cause a denial of service… |
| CVE-2019-12874 | VM Vlc Media Player Videolan | 9.8 | Jun 18 | An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7 |
| CVE-2019-5439 | VM Vlc Media Player Videolan | 6.5 | Jun 13 | A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit |
| CVE-2018-19937 | VF Vlc For Mobile Videolan | 6.6 | Dec 31 | A local, authenticated attacker can bypass the passcode in the VideoLAN VLC media player app before 3.1.5 for iOS by opening a URL and turning the phone |
| CVE-2018-19857 | VM Vlc Media Player Videolan | 9.1 | Dec 5 | The CAF demuxer in modules/demux/caf.c in VideoLAN VLC media player 3.0.4 may read memory from an uninitialized pointer when processing magic cookies in CAF files, because a… |
| CVE-2018-11529 | VM Vlc Media Player Videolan | 8.0 | Jul 11 | VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files |
| CVE-2018-11516 | VM Vlc Media Player Videolan | 8.8 | May 28 | The vlc_demux_chained_Delete function in input/demux_chained.c in VideoLAN VLC media player 3.0.1 allows remote attackers to cause a denial of service (heap corruption and… |
| CVE-2017-17670 | VM Vlc Media Player Videolan | 8.8 | Dec 15 | In VideoLAN VLC media player through 2.2.8, there is a type conversion vulnerability in modules/demux/mp4/libmp4.c in the MP4 demux module leading to a invalid free, because the… |
| CVE-2017-10699 | VM Vlc Media Player Videolan | 9.8 | Jun 30 | avcodec 2.2.x, as used in VideoLAN VLC media player 2.2.7-x before 2017-06-29, allows out-of-bounds heap memory write due to calling memcpy() with a wrong size, leading to a… |
| CVE-2017-9301 | VM Vlc Media Player Videolan | 7.8 | May 29 | plugins\audio_filter\libmpgatofixed32_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (invalid read and application crash) or… |
| CVE-2017-9300 | VM Vlc Media Player Videolan | 7.8 | May 29 | plugins\codec\libflac_plugin.dll in VideoLAN VLC media player 2.2.4 allows remote attackers to cause a denial of service (heap corruption and application crash) or possibly have… |
| CVE-2017-8313 | VM Vlc Media Player Videolan | 5.5 | May 23 | Heap out-of-bound read in ParseJSS in VideoLAN VLC before 2.2.5 due to missing check of string termination allows attackers to read data beyond allocated memory and potentially… |
| CVE-2017-8312 | VM Vlc Media Player Videolan | 5.5 | May 23 | Heap out-of-bound read in ParseJSS in VideoLAN VLC due to missing check of string length allows attackers to read heap uninitialized data via a crafted subtitles file |